@withpotter/lib 0.13.0-next.101

package/dist/api/core.js

@@ -0,0 +1,223 @@
+const IS_BROWSER = typeof window !== "undefined";
+import posthog from "posthog-js";
+import { notifyWrite } from "./cache-bus";
+import { announceFeatureLocked, featureNotInPlan } from "./feature-locked";
+import { announcePlanRefusal, planRefusal } from "./plan-refusal";
+import { isUnservedRoute, unservedMessage } from "./unserved-routes";
+import { refreshSession, wantsRefresh } from "./session-refresh";
+import {
+  isSessionExpiryResponse,
+  merchantIdentity,
+  sessionExpiryTarget
+} from "./session-scope";
+const getApiUrl = () => {
+  if (IS_BROWSER) {
+    return "/api/proxy";
+  }
+  return process.env.NEXT_PUBLIC_API_URL || "http://localhost:4000";
+};
+function getAccountId() {
+  if (typeof window === "undefined") return null;
+  const pbUser = localStorage.getItem("pb_user");
+  if (pbUser) {
+    try {
+      const user = JSON.parse(pbUser);
+      return user.id || null;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function getCsrfToken() {
+  if (typeof window === "undefined" || typeof document === "undefined")
+    return null;
+  const match = document.cookie.match(/pb_csrf_token=([^;]+)/);
+  return match ? match[1] : null;
+}
+class SessionExpiredError extends Error {
+  constructor() {
+    super("Your session has expired");
+    this.name = "SessionExpiredError";
+  }
+}
+class ApiRequestError extends Error {
+  constructor(message, status, details) {
+    super(message);
+    this.status = status;
+    this.details = details;
+    this.name = "ApiRequestError";
+  }
+  status;
+  details;
+}
+import { AUTH_ROUTES, isSessionExpiryResponse as isSessionExpiryResponse2 } from "./session-scope";
+let sessionExpiryHandled = false;
+const BOUNCE_KEY = "pb_session_bounce";
+const BOUNCE_WINDOW_MS = 15e3;
+function bouncedRecently(path) {
+  try {
+    const raw = sessionStorage.getItem(BOUNCE_KEY);
+    if (!raw) return false;
+    const { path: last, at } = JSON.parse(raw);
+    return last === path && Date.now() - at < BOUNCE_WINDOW_MS;
+  } catch {
+    return false;
+  }
+}
+function recordBounce(path) {
+  try {
+    sessionStorage.setItem(
+      BOUNCE_KEY,
+      JSON.stringify({ path, at: Date.now() })
+    );
+  } catch {
+  }
+}
+const inFlightGets = /* @__PURE__ */ new Map();
+const READ_ONLY_POSTS = [/^\/crm\/segments\/preview(\?|$)/];
+const onlyReads = (endpoint) => READ_ONLY_POSTS.some((pattern) => pattern.test(endpoint));
+async function apiFetch(endpoint, options = {}) {
+  const { tenantSlug, token, accountId, ...fetchOptions } = options;
+  const headers = {
+    ...fetchOptions.headers
+  };
+  if (fetchOptions.body && !(fetchOptions.body instanceof FormData)) {
+    headers["Content-Type"] = "application/json";
+  }
+  if (tenantSlug) {
+    headers["X-Tenant-Slug"] = tenantSlug;
+  }
+  const merchant = merchantIdentity(endpoint, getAccountId(), null);
+  const effectiveAccountId = accountId || merchant.accountId;
+  if (effectiveAccountId) {
+    headers["x-account-id"] = effectiveAccountId;
+  }
+  const effectiveToken = token || merchant.token;
+  if (effectiveToken) {
+    headers.Authorization = `Bearer ${effectiveToken}`;
+  }
+  const method = (fetchOptions.method || "GET").toUpperCase();
+  const isWrite = ["POST", "PUT", "PATCH", "DELETE"].includes(method);
+  if (isWrite) {
+    const csrfToken = getCsrfToken();
+    if (csrfToken) {
+      headers["X-CSRF-Token"] = csrfToken;
+    }
+  }
+  if (IS_BROWSER) {
+    headers["x-request-id"] = crypto.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+    const sessionId = posthog.get_session_id?.();
+    if (sessionId) {
+      headers["x-posthog-session-id"] = sessionId;
+    }
+  }
+  if (isUnservedRoute(endpoint)) {
+    throw new ApiRequestError(unservedMessage(method, endpoint), 404);
+  }
+  const url = `${getApiUrl()}${endpoint}`;
+  if (method === "GET") {
+    const key = `${url}|${tenantSlug ?? ""}|${effectiveAccountId ?? ""}`;
+    const inFlight = inFlightGets.get(key);
+    if (inFlight) return inFlight;
+    const started = send(url, fetchOptions, headers, isWrite && !onlyReads(endpoint)).finally(() => {
+      inFlightGets.delete(key);
+    });
+    inFlightGets.set(key, started);
+    return started;
+  }
+  return send(url, fetchOptions, headers, isWrite && !onlyReads(endpoint));
+}
+async function send(url, fetchOptions, headers, isWrite, retried = false) {
+  const res = await fetch(url, {
+    ...fetchOptions,
+    headers,
+    credentials: "include"
+    // Include cookies for CSRF
+  });
+  if (!res.ok) {
+    if (res.status === 401 && !retried && wantsRefresh(url)) {
+      const body = await res.clone().json().catch(() => null);
+      if (wantsRefresh(url, body) && await refreshSession(getApiUrl())) {
+        return send(url, fetchOptions, headers, isWrite, true);
+      }
+    }
+    const lockedBody = res.status === 402 ? await res.clone().json().catch(() => null) : null;
+    const locked = featureNotInPlan(lockedBody);
+    if (locked) {
+      announceFeatureLocked(locked);
+      throw new ApiRequestError(lockedBody.message ?? "Not in your plan", 402, lockedBody);
+    }
+    const refusal = planRefusal(lockedBody);
+    if (refusal) {
+      announcePlanRefusal(refusal);
+      throw new ApiRequestError(
+        refusal.code === "LIMIT_REACHED" ? "You have reached the limit on your plan" : "This is not available on your plan",
+        402,
+        lockedBody
+      );
+    }
+    if (res.status === 402 && IS_BROWSER) {
+      window.location.href = "/dashboard/settings/billing";
+      throw new Error("Payment required");
+    }
+    if (isSessionExpiryResponse(res.status, url) && IS_BROWSER) {
+      const path = window.location.pathname;
+      const target = sessionExpiryTarget(url, path, window.location.search);
+      if (target && !sessionExpiryHandled && !bouncedRecently(path)) {
+        sessionExpiryHandled = true;
+        recordBounce(path);
+        window.location.href = target;
+      }
+      throw new SessionExpiredError();
+    }
+    const error = await res.json().catch(() => ({ message: "Request failed" }));
+    let msg;
+    if (Array.isArray(error.message)) {
+      const items = error.message.map((m) => {
+        const colonIdx = m.indexOf(": ");
+        return colonIdx > -1 ? m.slice(colonIdx + 2) : m;
+      }).filter((m, i, arr) => arr.indexOf(m) === i);
+      msg = items.length > 0 ? "\u2022 " + items.join("\n\u2022 ") : error.error || `HTTP ${res.status}`;
+    } else {
+      msg = error.message || error.error || `HTTP ${res.status}`;
+    }
+    throw new ApiRequestError(msg, res.status, error);
+  }
+  if (isWrite) {
+    notifyWrite();
+  }
+  if (res.status === 204) {
+    return void 0;
+  }
+  const contentType = res.headers.get("content-type");
+  if (!contentType || !contentType.includes("application/json")) {
+    const text = await res.text();
+    if (!text) {
+      return void 0;
+    }
+    return text;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return void 0;
+    }
+  }
+  return res.json();
+}
+export {
+  AUTH_ROUTES,
+  ApiRequestError,
+  BOUNCE_KEY,
+  BOUNCE_WINDOW_MS,
+  IS_BROWSER,
+  SessionExpiredError,
+  apiFetch,
+  bouncedRecently,
+  getAccountId,
+  getApiUrl,
+  getCsrfToken,
+  isSessionExpiryResponse2 as isSessionExpiryResponse,
+  recordBounce
+};
+//# sourceMappingURL=core.js.map

package/dist/api/core.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/core.ts"],"sourcesContent":["/**\n * The shared plumbing every API module needs: auth token, CSRF, the bounce\n * guard, and apiFetch itself.\n *\n * Split out of the old 7,657-line src/lib/api.ts. That file was imported by\n * 405 files, so touching any endpoint invalidated all of them, and a route\n * that wanted one call pulled the whole surface.\n */\n// Always use proxy for cookie-based auth to work (same-origin required for cookies)\nexport const IS_BROWSER = typeof window !== 'undefined';\n\nimport posthog from 'posthog-js';\nimport type { FetchOptions } from './types';\nimport { notifyWrite } from './cache-bus';\nimport { announceFeatureLocked, featureNotInPlan } from './feature-locked';\nimport { announcePlanRefusal, planRefusal } from './plan-refusal';\nimport { isUnservedRoute, unservedMessage } from './unserved-routes';\nimport { refreshSession, wantsRefresh } from './session-refresh';\nimport {\n  isSessionExpiryResponse,\n  merchantIdentity,\n  sessionExpiryTarget,\n} from './session-scope';\n\n// Use proxy for all browser requests to ensure cookies are sent correctly\n\n// Use proxy for all browser requests to ensure cookies are sent correctly\nexport const getApiUrl = () => {\n  if (IS_BROWSER) {\n    // In browser, route through our proxy for same-origin cookie handling\n    return '/api/proxy';\n  }\n  // Server-side, use direct backend URL\n  return process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000';\n};\n\n// Helper to get account ID from localStorage\n\n// Helper to get account ID from localStorage\nexport function getAccountId(): string | null {\n  if (typeof window === 'undefined') return null;\n  const pbUser = localStorage.getItem('pb_user');\n  if (pbUser) {\n    try {\n      const user = JSON.parse(pbUser);\n      return user.id || null;\n    } catch {\n      return null;\n    }\n  }\n  return null;\n}\n\n// Helper to get CSRF token from cookie\n\n// Helper to get CSRF token from cookie\nexport function getCsrfToken(): string | null {\n  if (typeof window === 'undefined' || typeof document === 'undefined')\n    return null;\n  const match = document.cookie.match(/pb_csrf_token=([^;]+)/);\n  return match ? match[1] : null;\n}\n\n/**\n * Thrown when the API rejects the session (401). Typed so a caller can tell an\n * expired session apart from a genuine empty result — the distinction the whole\n * dashboard was previously unable to make.\n */\nexport class SessionExpiredError extends Error {\n  constructor() {\n    super('Your session has expired');\n    this.name = 'SessionExpiredError';\n  }\n}\n\nexport class ApiRequestError extends Error {\n  constructor(\n    message: string,\n    readonly status: number,\n    readonly details?: unknown,\n  ) {\n    super(message);\n    this.name = 'ApiRequestError';\n  }\n}\n\nexport { AUTH_ROUTES, isSessionExpiryResponse } from './session-scope';\n\n/** One redirect per page load, however many requests fail together. */\nlet sessionExpiryHandled = false;\n\n/**\n * Where we last sent someone to log in, and when. Bouncing to login is a full\n * page load, so the in-memory guard above resets every time — it cannot see a\n * loop. This can.\n */\n\n/**\n * Where we last sent someone to log in, and when. Bouncing to login is a full\n * page load, so the in-memory guard above resets every time — it cannot see a\n * loop. This can.\n */\nexport const BOUNCE_KEY = 'pb_session_bounce';\n/** Two bounces off the same path inside this window is a loop, not a login. */\n\n/** Two bounces off the same path inside this window is a loop, not a login. */\nexport const BOUNCE_WINDOW_MS = 15_000;\n\n/**\n * True when we already bounced this path to login and are right back on it.\n *\n * That combination means the session is fine — login only returns you here if\n * it recognises you — and some single endpoint is answering 401 for its own\n * reasons (a missing tenant header, say). Bouncing again just repeats the\n * round trip forever, which the merchant sees as a page that reloads and\n * reloads. Better to let that one panel fail and leave the page standing.\n */\n\n/**\n * True when we already bounced this path to login and are right back on it.\n *\n * That combination means the session is fine — login only returns you here if\n * it recognises you — and some single endpoint is answering 401 for its own\n * reasons (a missing tenant header, say). Bouncing again just repeats the\n * round trip forever, which the merchant sees as a page that reloads and\n * reloads. Better to let that one panel fail and leave the page standing.\n */\nexport function bouncedRecently(path: string): boolean {\n  try {\n    const raw = sessionStorage.getItem(BOUNCE_KEY);\n    if (!raw) return false;\n    const { path: last, at } = JSON.parse(raw) as { path: string; at: number };\n    return last === path && Date.now() - at < BOUNCE_WINDOW_MS;\n  } catch {\n    return false;\n  }\n}\n\nexport function recordBounce(path: string): void {\n  try {\n    sessionStorage.setItem(\n      BOUNCE_KEY,\n      JSON.stringify({ path, at: Date.now() }),\n    );\n  } catch {\n    // Private mode / storage full. The in-memory guard still holds for this\n    // page load; we just lose the cross-reload half of the protection.\n  }\n}\n\n/**\n * GETS THAT OVERLAP IN TIME ARE ONE REQUEST.\n *\n * Not a cache — an entry lives only while its request is in the air, so this\n * can never hand back a stale answer. It collapses the case the dashboard\n * actually has: several components asking the same question in the same tick,\n * each with its own `useEffect` and nothing to dedupe against.\n *\n * Measured per page load before this, on a real workspace: `/pages` six times\n * on the editor, `products` five on the catalogue, `analytics/dashboard` four,\n * `orders` three. React Query dedupes what goes through it; roughly forty files\n * still fetch in a raw effect and those are all of the above.\n *\n * GET only, and keyed by the things that change the ANSWER — the URL, the\n * workspace and the account. A write is never collapsed: two POSTs that look\n * identical are two things happening.\n */\nconst inFlightGets = new Map<string, Promise<unknown>>();\n\n/**\n * POSTs that ask a question and change nothing: the filters are too large for a\n * query string. They must not announce a write. A query built on one would\n * invalidate every query on success, itself included, and so refetch for ever\n * (the New campaign screen counted its audience a few hundred times a minute).\n */\nconst READ_ONLY_POSTS = [/^\\/crm\\/segments\\/preview(\\?|$)/];\nconst onlyReads = (endpoint: string) =>\n  READ_ONLY_POSTS.some((pattern) => pattern.test(endpoint));\n\nexport async function apiFetch<T = unknown>(\n  endpoint: string,\n  options: FetchOptions = {},\n): Promise<T> {\n  const { tenantSlug, token, accountId, ...fetchOptions } = options;\n\n  const headers: Record<string, string> = {\n    ...(fetchOptions.headers as Record<string, string>),\n  };\n\n  // Let the runtime add the multipart boundary for FormData uploads.\n  if (fetchOptions.body && !(fetchOptions.body instanceof FormData)) {\n    headers['Content-Type'] = 'application/json';\n  }\n\n  if (tenantSlug) {\n    headers['X-Tenant-Slug'] = tenantSlug;\n  }\n\n  // The merchant's account goes on merchant calls only. The session itself is\n  // the HttpOnly pb_auth_token cookie, which the browser sends; only a caller\n  // holding a fresh one-time token (an invite link) passes `token` here.\n  const merchant = merchantIdentity(endpoint, getAccountId(), null);\n  const effectiveAccountId = accountId || merchant.accountId;\n  if (effectiveAccountId) {\n    headers['x-account-id'] = effectiveAccountId;\n  }\n\n  const effectiveToken = token || merchant.token;\n  if (effectiveToken) {\n    headers.Authorization = `Bearer ${effectiveToken}`;\n  }\n\n  // Add CSRF token for state-changing requests (POST, PUT, PATCH, DELETE)\n  const method = (fetchOptions.method || 'GET').toUpperCase();\n  // Reused below to announce the write. The list is the same one CSRF cares\n  // about for the same reason: these are the methods that change something.\n  const isWrite = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method);\n  if (isWrite) {\n    const csrfToken = getCsrfToken();\n    if (csrfToken) {\n      headers['X-CSRF-Token'] = csrfToken;\n    }\n  }\n\n  // Request tracing: unique ID per API call + PostHog session correlation\n  if (IS_BROWSER) {\n    headers['x-request-id'] =\n      crypto.randomUUID?.() ??\n      `${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;\n    const sessionId = posthog.get_session_id?.();\n    if (sessionId) {\n      headers['x-posthog-session-id'] = sessionId;\n    }\n  }\n\n  // A route this box's engine does not serve fails here, as the engine would.\n  if (isUnservedRoute(endpoint)) {\n    throw new ApiRequestError(unservedMessage(method, endpoint), 404);\n  }\n\n  const url = `${getApiUrl()}${endpoint}`;\n\n  if (method === 'GET') {\n    const key = `${url}|${tenantSlug ?? ''}|${effectiveAccountId ?? ''}`;\n    const inFlight = inFlightGets.get(key);\n    if (inFlight) return inFlight as Promise<T>;\n    const started = send<T>(url, fetchOptions, headers, isWrite && !onlyReads(endpoint)).finally(() => {\n      inFlightGets.delete(key);\n    });\n    inFlightGets.set(key, started);\n    return started;\n  }\n\n  return send<T>(url, fetchOptions, headers, isWrite && !onlyReads(endpoint));\n}\n\n/** The request itself, once `apiFetch` has decided who is making it. */\nasync function send<T>(\n  url: string,\n  fetchOptions: Omit<FetchOptions, 'tenantSlug' | 'token' | 'accountId'>,\n  headers: Record<string, string>,\n  isWrite: boolean,\n  retried = false,\n): Promise<T> {\n  const res = await fetch(url, {\n    ...fetchOptions,\n    headers,\n    credentials: 'include', // Include cookies for CSRF\n  });\n\n  if (!res.ok) {\n    // The 15-minute access token ran out but the refresh cookie may still be\n    // good: renew once, shared by every request that failed together, and\n    // send this one again. Anything else falls through to the old handling.\n    if (res.status === 401 && !retried && wantsRefresh(url)) {\n      const body = await res.clone().json().catch(() => null);\n      if (wantsRefresh(url, body) && (await refreshSession(getApiUrl()))) {\n        return send<T>(url, fetchOptions, headers, isWrite, true);\n      }\n    }\n\n    // 402 Payment Required — subscription inactive, redirect to billing\n    // ...unless the plan guard sent it: a page the plan leaves out shows the\n    // locked-feature card, and the merchant stays where they are.\n    const lockedBody =\n      res.status === 402\n        ? await res.clone().json().catch(() => null)\n        : null;\n    const locked = featureNotInPlan(lockedBody);\n    if (locked) {\n      announceFeatureLocked(locked);\n      throw new ApiRequestError(lockedBody.message ?? 'Not in your plan', 402, lockedBody);\n    }\n    const refusal = planRefusal(lockedBody);\n    if (refusal) {\n      announcePlanRefusal(refusal);\n      throw new ApiRequestError(\n        refusal.code === 'LIMIT_REACHED'\n          ? 'You have reached the limit on your plan'\n          : 'This is not available on your plan',\n        402,\n        lockedBody,\n      );\n    }\n    if (res.status === 402 && IS_BROWSER) {\n      window.location.href = '/dashboard/settings/billing';\n      throw new Error('Payment required');\n    }\n\n    /**\n     * 401 — the session is gone, not the data.\n     *\n     * Handled here because it cannot be handled well anywhere else: every panel\n     * catches its own failure and renders an empty state, so an expired session\n     * was being drawn as £0 revenue, 0 bookings and \"nothing yet\" across the\n     * whole dashboard. That tells a merchant their business made nothing, when\n     * in fact the app cannot talk to the server. A 401 is never an empty state.\n     *\n     * 403 is deliberately NOT caught: that is a real permission answer for a\n     * valid session, and panels are right to hide themselves for it.\n     *\n     * The guard matters — a dashboard fires a dozen requests at once, and all\n     * of them 401 together. Without it they'd each kick off a navigation.\n     */\n    if (isSessionExpiryResponse(res.status, url) && IS_BROWSER) {\n      // An admin 401 goes to the admin sign-in, never the merchant one: that\n      // forwards a signed-in merchant to /dashboard.\n      const path = window.location.pathname;\n      const target = sessionExpiryTarget(url, path, window.location.search);\n      if (target && !sessionExpiryHandled && !bouncedRecently(path)) {\n        sessionExpiryHandled = true;\n        recordBounce(path);\n        window.location.href = target;\n      }\n      throw new SessionExpiredError();\n    }\n\n    const error = await res.json().catch(() => ({ message: 'Request failed' }));\n    // NestJS validation pipes return message as an array of strings\n    let msg: string;\n    if (Array.isArray(error.message)) {\n      const items = error.message\n        .map((m: string) => {\n          // Strip field prefix like \"maxDiscountAmount: maxDiscountAmount must...\"\n          const colonIdx = m.indexOf(': ');\n          return colonIdx > -1 ? m.slice(colonIdx + 2) : m;\n        })\n        .filter((m: string, i: number, arr: string[]) => arr.indexOf(m) === i);\n      // When NestJS returns an empty message array, fall back to error.error\n      msg =\n        items.length > 0\n          ? '• ' + items.join('\\n• ')\n          : error.error || `HTTP ${res.status}`;\n    } else {\n      msg = error.message || error.error || `HTTP ${res.status}`;\n    }\n    // Carry the status. Callers were reduced to matching on message text to\n    // tell \"the server refused this\" from \"the server could not be reached\",\n    // and those need opposite handling: one means the session is dead, the\n    // other means fall back to cache and carry on.\n    //\n    // `details` carries the parsed body for the same reason, one level in. An\n    // API that answers a refusal with a machine-readable code and the id of the\n    // thing that caused it was having all of that thrown away here, leaving the\n    // caller to substring-match the human sentence — which is how a recoverable\n    // refusal (\"you already have one of these, connect it\") becomes a dead end.\n    throw new ApiRequestError(msg, res.status, error);\n  }\n\n  /**\n   * THE WRITE LANDED, SO WHAT IS ON SCREEN IS NOW OUT OF DATE.\n   *\n   * Announced here rather than at a hundred call sites, because this is the\n   * only place that knows a write happened at all — see `cache-bus.ts` for why\n   * that matters and what it fixes. Only after `res.ok`: a refused write has\n   * changed nothing and refetching over it would be noise.\n   */\n  if (isWrite) {\n    notifyWrite();\n  }\n\n  // 204 No Content has no body — return early to avoid JSON parse error\n  if (res.status === 204) {\n    return undefined as unknown as T;\n  }\n\n  // Handle empty response body (e.g., 200 OK with no content)\n  const contentType = res.headers.get('content-type');\n  if (!contentType || !contentType.includes('application/json')) {\n    // Check if response has content\n    const text = await res.text();\n    if (!text) {\n      return undefined as unknown as T;\n    }\n    return text as T;\n    // Try to parse as JSON in case content-type header is missing\n    try {\n      return JSON.parse(text) as T;\n    } catch {\n      return undefined as unknown as T;\n    }\n  }\n\n  return res.json();\n}\n\n// ============================================\n// AUTH / ACCOUNTS API\n// ============================================\n"],"mappings":"AASO,MAAM,aAAa,OAAO,WAAW;AAE5C,OAAO,aAAa;AAEpB,SAAS,mBAAmB;AAC5B,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,qBAAqB,mBAAmB;AACjD,SAAS,iBAAiB,uBAAuB;AACjD,SAAS,gBAAgB,oBAAoB;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKA,MAAM,YAAY,MAAM;AAC7B,MAAI,YAAY;AAEd,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,IAAI,uBAAuB;AAC5C;AAKO,SAAS,eAA8B;AAC5C,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,SAAS,aAAa,QAAQ,SAAS;AAC7C,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,MAAM;AAC9B,aAAO,KAAK,MAAM;AAAA,IACpB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,eAA8B;AAC5C,MAAI,OAAO,WAAW,eAAe,OAAO,aAAa;AACvD,WAAO;AACT,QAAM,QAAQ,SAAS,OAAO,MAAM,uBAAuB;AAC3D,SAAO,QAAQ,MAAM,CAAC,IAAI;AAC5B;AAOO,MAAM,4BAA4B,MAAM;AAAA,EAC7C,cAAc;AACZ,UAAM,0BAA0B;AAChC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,wBAAwB,MAAM;AAAA,EACzC,YACE,SACS,QACA,SACT;AACA,UAAM,OAAO;AAHJ;AACA;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAAA,EACA;AAKb;AAEA,SAAS,aAAa,2BAAAA,gCAA+B;AAGrD,IAAI,uBAAuB;AAapB,MAAM,aAAa;AAInB,MAAM,mBAAmB;AAqBzB,SAAS,gBAAgB,MAAuB;AACrD,MAAI;AACF,UAAM,MAAM,eAAe,QAAQ,UAAU;AAC7C,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,EAAE,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG;AACzC,WAAO,SAAS,QAAQ,KAAK,IAAI,IAAI,KAAK;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,MAAoB;AAC/C,MAAI;AACF,mBAAe;AAAA,MACb;AAAA,MACA,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,IAAI,EAAE,CAAC;AAAA,IACzC;AAAA,EACF,QAAQ;AAAA,EAGR;AACF;AAmBA,MAAM,eAAe,oBAAI,IAA8B;AAQvD,MAAM,kBAAkB,CAAC,iCAAiC;AAC1D,MAAM,YAAY,CAAC,aACjB,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,QAAQ,CAAC;AAE1D,eAAsB,SACpB,UACA,UAAwB,CAAC,GACb;AACZ,QAAM,EAAE,YAAY,OAAO,WAAW,GAAG,aAAa,IAAI;AAE1D,QAAM,UAAkC;AAAA,IACtC,GAAI,aAAa;AAAA,EACnB;AAGA,MAAI,aAAa,QAAQ,EAAE,aAAa,gBAAgB,WAAW;AACjE,YAAQ,cAAc,IAAI;AAAA,EAC5B;AAEA,MAAI,YAAY;AACd,YAAQ,eAAe,IAAI;AAAA,EAC7B;AAKA,QAAM,WAAW,iBAAiB,UAAU,aAAa,GAAG,IAAI;AAChE,QAAM,qBAAqB,aAAa,SAAS;AACjD,MAAI,oBAAoB;AACtB,YAAQ,cAAc,IAAI;AAAA,EAC5B;AAEA,QAAM,iBAAiB,SAAS,SAAS;AACzC,MAAI,gBAAgB;AAClB,YAAQ,gBAAgB,UAAU,cAAc;AAAA,EAClD;AAGA,QAAM,UAAU,aAAa,UAAU,OAAO,YAAY;AAG1D,QAAM,UAAU,CAAC,QAAQ,OAAO,SAAS,QAAQ,EAAE,SAAS,MAAM;AAClE,MAAI,SAAS;AACX,UAAM,YAAY,aAAa;AAC/B,QAAI,WAAW;AACb,cAAQ,cAAc,IAAI;AAAA,IAC5B;AAAA,EACF;AAGA,MAAI,YAAY;AACd,YAAQ,cAAc,IACpB,OAAO,aAAa,KACpB,GAAG,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AACzD,UAAM,YAAY,QAAQ,iBAAiB;AAC3C,QAAI,WAAW;AACb,cAAQ,sBAAsB,IAAI;AAAA,IACpC;AAAA,EACF;AAGA,MAAI,gBAAgB,QAAQ,GAAG;AAC7B,UAAM,IAAI,gBAAgB,gBAAgB,QAAQ,QAAQ,GAAG,GAAG;AAAA,EAClE;AAEA,QAAM,MAAM,GAAG,UAAU,CAAC,GAAG,QAAQ;AAErC,MAAI,WAAW,OAAO;AACpB,UAAM,MAAM,GAAG,GAAG,IAAI,cAAc,EAAE,IAAI,sBAAsB,EAAE;AAClE,UAAM,WAAW,aAAa,IAAI,GAAG;AACrC,QAAI,SAAU,QAAO;AACrB,UAAM,UAAU,KAAQ,KAAK,cAAc,SAAS,WAAW,CAAC,UAAU,QAAQ,CAAC,EAAE,QAAQ,MAAM;AACjG,mBAAa,OAAO,GAAG;AAAA,IACzB,CAAC;AACD,iBAAa,IAAI,KAAK,OAAO;AAC7B,WAAO;AAAA,EACT;AAEA,SAAO,KAAQ,KAAK,cAAc,SAAS,WAAW,CAAC,UAAU,QAAQ,CAAC;AAC5E;AAGA,eAAe,KACb,KACA,cACA,SACA,SACA,UAAU,OACE;AACZ,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,GAAG;AAAA,IACH;AAAA,IACA,aAAa;AAAA;AAAA,EACf,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AAIX,QAAI,IAAI,WAAW,OAAO,CAAC,WAAW,aAAa,GAAG,GAAG;AACvD,YAAM,OAAO,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,IAAI;AACtD,UAAI,aAAa,KAAK,IAAI,KAAM,MAAM,eAAe,UAAU,CAAC,GAAI;AAClE,eAAO,KAAQ,KAAK,cAAc,SAAS,SAAS,IAAI;AAAA,MAC1D;AAAA,IACF;AAKA,UAAM,aACJ,IAAI,WAAW,MACX,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,IAAI,IACzC;AACN,UAAM,SAAS,iBAAiB,UAAU;AAC1C,QAAI,QAAQ;AACV,4BAAsB,MAAM;AAC5B,YAAM,IAAI,gBAAgB,WAAW,WAAW,oBAAoB,KAAK,UAAU;AAAA,IACrF;AACA,UAAM,UAAU,YAAY,UAAU;AACtC,QAAI,SAAS;AACX,0BAAoB,OAAO;AAC3B,YAAM,IAAI;AAAA,QACR,QAAQ,SAAS,kBACb,4CACA;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI,WAAW,OAAO,YAAY;AACpC,aAAO,SAAS,OAAO;AACvB,YAAM,IAAI,MAAM,kBAAkB;AAAA,IACpC;AAiBA,QAAI,wBAAwB,IAAI,QAAQ,GAAG,KAAK,YAAY;AAG1D,YAAM,OAAO,OAAO,SAAS;AAC7B,YAAM,SAAS,oBAAoB,KAAK,MAAM,OAAO,SAAS,MAAM;AACpE,UAAI,UAAU,CAAC,wBAAwB,CAAC,gBAAgB,IAAI,GAAG;AAC7D,+BAAuB;AACvB,qBAAa,IAAI;AACjB,eAAO,SAAS,OAAO;AAAA,MACzB;AACA,YAAM,IAAI,oBAAoB;AAAA,IAChC;AAEA,UAAM,QAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,EAAE,SAAS,iBAAiB,EAAE;AAE1E,QAAI;AACJ,QAAI,MAAM,QAAQ,MAAM,OAAO,GAAG;AAChC,YAAM,QAAQ,MAAM,QACjB,IAAI,CAAC,MAAc;AAElB,cAAM,WAAW,EAAE,QAAQ,IAAI;AAC/B,eAAO,WAAW,KAAK,EAAE,MAAM,WAAW,CAAC,IAAI;AAAA,MACjD,CAAC,EACA,OAAO,CAAC,GAAW,GAAW,QAAkB,IAAI,QAAQ,CAAC,MAAM,CAAC;AAEvE,YACE,MAAM,SAAS,IACX,YAAO,MAAM,KAAK,WAAM,IACxB,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,IACzC,OAAO;AACL,YAAM,MAAM,WAAW,MAAM,SAAS,QAAQ,IAAI,MAAM;AAAA,IAC1D;AAWA,UAAM,IAAI,gBAAgB,KAAK,IAAI,QAAQ,KAAK;AAAA,EAClD;AAUA,MAAI,SAAS;AACX,gBAAY;AAAA,EACd;AAGA,MAAI,IAAI,WAAW,KAAK;AACtB,WAAO;AAAA,EACT;AAGA,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc;AAClD,MAAI,CAAC,eAAe,CAAC,YAAY,SAAS,kBAAkB,GAAG;AAE7D,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,IACT;AACA,WAAO;AAEP,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,IAAI,KAAK;AAClB;","names":["isSessionExpiryResponse"]}

package/dist/api/credentials.d.ts

@@ -0,0 +1,65 @@
+import type { Band } from './types';
+/**
+ * Bands, and the balances they point at.
+ *
+ * The band carries no value — it points at the holder — which is why a lost one
+ * is replaced rather than mourned, and why the balance stays put when it is.
+ */
+export declare const bandsApi: {
+    list: (tenantSlug: string, memberId?: string) => Promise<{
+        credentials: Band[];
+    }>;
+    issue: (tenantSlug: string, data: {
+        memberId: string;
+        kind: Band["kind"];
+        uid: string;
+        label?: string;
+        /** Declared, never detected: a cheap tag and a DNA tag both report a UID. */
+        secure?: boolean;
+    }) => Promise<Band>;
+    /** The old one stops working, the new one starts, the balance never moves. */
+    replace: (tenantSlug: string, id: string, data: {
+        uid: string;
+        secure?: boolean;
+    }) => Promise<{
+        replaced: Band;
+        issued: Band;
+    }>;
+    setStatus: (tenantSlug: string, id: string, status: "active" | "lost" | "expired" | "revoked") => Promise<Band>;
+    /** The one moment real money arrives. */
+    topUp: (tenantSlug: string, data: {
+        memberId: string;
+        amount: number;
+        channel: string;
+        note?: string;
+    }) => Promise<{
+        memberId: string;
+        balance: number;
+        transactionId: string;
+    }>;
+    /** Puts a spend back. No money moves, so nothing is written to the books. */
+    voidSpend: (tenantSlug: string, data: {
+        memberId: string;
+        amount: number;
+        note?: string;
+    }) => Promise<{
+        memberId: string;
+        balance: number;
+    }>;
+    /**
+     * Gives back what a customer never spent.
+     *
+     * Real cash leaves the till, unlike a void — so this writes a refund, and
+     * `channel` says where the money came from.
+     */
+    cashOut: (tenantSlug: string, data: {
+        memberId: string;
+        amount?: number;
+        channel: string;
+        note?: string;
+    }) => Promise<{
+        memberId: string;
+        balance: number;
+        transactionId: string;
+    }>;
+};

package/dist/api/credentials.js

@@ -0,0 +1,48 @@
+import { apiFetch } from "./core";
+const bandsApi = {
+  list: (tenantSlug, memberId) => apiFetch(
+    memberId ? `/credentials?memberId=${encodeURIComponent(memberId)}` : "/credentials",
+    { tenantSlug }
+  ),
+  issue: (tenantSlug, data) => apiFetch("/credentials", {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify(data)
+  }),
+  /** The old one stops working, the new one starts, the balance never moves. */
+  replace: (tenantSlug, id, data) => apiFetch(`/credentials/${id}/replace`, {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify(data)
+  }),
+  setStatus: (tenantSlug, id, status) => apiFetch(`/credentials/${id}/status`, {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify({ status })
+  }),
+  /** The one moment real money arrives. */
+  topUp: (tenantSlug, data) => apiFetch(
+    "/credentials/top-up",
+    { tenantSlug, method: "POST", body: JSON.stringify(data) }
+  ),
+  /** Puts a spend back. No money moves, so nothing is written to the books. */
+  voidSpend: (tenantSlug, data) => apiFetch("/credentials/void", {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify(data)
+  }),
+  /**
+   * Gives back what a customer never spent.
+   *
+   * Real cash leaves the till, unlike a void — so this writes a refund, and
+   * `channel` says where the money came from.
+   */
+  cashOut: (tenantSlug, data) => apiFetch(
+    "/credentials/cash-out",
+    { tenantSlug, method: "POST", body: JSON.stringify(data) }
+  )
+};
+export {
+  bandsApi
+};
+//# sourceMappingURL=credentials.js.map

package/dist/api/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/credentials.ts"],"sourcesContent":["import { apiFetch } from './core';\nimport type { Band } from './types';\n\n/**\n * Bands, and the balances they point at.\n *\n * The band carries no value — it points at the holder — which is why a lost one\n * is replaced rather than mourned, and why the balance stays put when it is.\n */\nexport const bandsApi = {\n  list: (tenantSlug: string, memberId?: string) =>\n    apiFetch<{ credentials: Band[] }>(\n      memberId\n        ? `/credentials?memberId=${encodeURIComponent(memberId)}`\n        : '/credentials',\n      { tenantSlug },\n    ),\n\n  issue: (\n    tenantSlug: string,\n    data: {\n      memberId: string;\n      kind: Band['kind'];\n      uid: string;\n      label?: string;\n      /** Declared, never detected: a cheap tag and a DNA tag both report a UID. */\n      secure?: boolean;\n    },\n  ) =>\n    apiFetch<Band>('/credentials', {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify(data),\n    }),\n\n  /** The old one stops working, the new one starts, the balance never moves. */\n  replace: (\n    tenantSlug: string,\n    id: string,\n    data: { uid: string; secure?: boolean },\n  ) =>\n    apiFetch<{ replaced: Band; issued: Band }>(`/credentials/${id}/replace`, {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify(data),\n    }),\n\n  setStatus: (\n    tenantSlug: string,\n    id: string,\n    status: 'active' | 'lost' | 'expired' | 'revoked',\n  ) =>\n    apiFetch<Band>(`/credentials/${id}/status`, {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify({ status }),\n    }),\n\n  /** The one moment real money arrives. */\n  topUp: (\n    tenantSlug: string,\n    data: {\n      memberId: string;\n      amount: number;\n      channel: string;\n      note?: string;\n    },\n  ) =>\n    apiFetch<{ memberId: string; balance: number; transactionId: string }>(\n      '/credentials/top-up',\n      { tenantSlug, method: 'POST', body: JSON.stringify(data) },\n    ),\n\n  /** Puts a spend back. No money moves, so nothing is written to the books. */\n  voidSpend: (\n    tenantSlug: string,\n    data: { memberId: string; amount: number; note?: string },\n  ) =>\n    apiFetch<{ memberId: string; balance: number }>('/credentials/void', {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * Gives back what a customer never spent.\n   *\n   * Real cash leaves the till, unlike a void — so this writes a refund, and\n   * `channel` says where the money came from.\n   */\n  cashOut: (\n    tenantSlug: string,\n    data: { memberId: string; amount?: number; channel: string; note?: string },\n  ) =>\n    apiFetch<{ memberId: string; balance: number; transactionId: string }>(\n      '/credentials/cash-out',\n      { tenantSlug, method: 'POST', body: JSON.stringify(data) },\n    ),\n};\n"],"mappings":"AAAA,SAAS,gBAAgB;AASlB,MAAM,WAAW;AAAA,EACtB,MAAM,CAAC,YAAoB,aACzB;AAAA,IACE,WACI,yBAAyB,mBAAmB,QAAQ,CAAC,KACrD;AAAA,IACJ,EAAE,WAAW;AAAA,EACf;AAAA,EAEF,OAAO,CACL,YACA,SASA,SAAe,gBAAgB;AAAA,IAC7B;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA,EAGH,SAAS,CACP,YACA,IACA,SAEA,SAA2C,gBAAgB,EAAE,YAAY;AAAA,IACvE;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA,EAEH,WAAW,CACT,YACA,IACA,WAEA,SAAe,gBAAgB,EAAE,WAAW;AAAA,IAC1C;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;AAAA,EACjC,CAAC;AAAA;AAAA,EAGH,OAAO,CACL,YACA,SAOA;AAAA,IACE;AAAA,IACA,EAAE,YAAY,QAAQ,QAAQ,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,EAC3D;AAAA;AAAA,EAGF,WAAW,CACT,YACA,SAEA,SAAgD,qBAAqB;AAAA,IACnE;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,SAAS,CACP,YACA,SAEA;AAAA,IACE;AAAA,IACA,EAAE,YAAY,QAAQ,QAAQ,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,EAC3D;AACJ;","names":[]}

package/dist/api/credits.d.ts

@@ -0,0 +1,96 @@
+export type MessagingChannel = 'sms' | 'whatsapp';
+export type MessageCategory = 'marketing' | 'utility' | 'authentication' | 'service';
+/**
+ * One grant of credits.
+ *
+ * Credits used to be a single number, which could not say where any of it came
+ * from or when it goes away. A block can: a plan allowance carries an expiry,
+ * purchased credits do not, and the two are spent soonest-expiry first.
+ */
+export interface CreditBlock {
+    id: string;
+    source: 'purchase' | 'plan' | 'bonus' | 'migration' | 'adjustment';
+    amount: number;
+    remaining: number;
+    unitPriceKobo: number;
+    expiresAt: string | null;
+    grantedAt: string;
+    description: string | null;
+}
+export interface CreditSummary {
+    spendable: number;
+    /** Money taken for credits not yet spent. Box's liability, not revenue. */
+    deferredRevenueKobo: number;
+    expiringSoon: {
+        credits: number;
+        at: string | null;
+    };
+    blocks: CreditBlock[];
+}
+/**
+ * Whether a send can finish, asked before it starts.
+ *
+ * `reachableNow` is the number that matters when a balance is short: not
+ * "insufficient" but "this reaches 40 of your 100 people".
+ */
+export interface CampaignQuote {
+    recipients: number;
+    channel: MessagingChannel;
+    category: MessageCategory;
+    creditsPerMessage: number;
+    creditsRequired: number;
+    creditsAvailable: number;
+    shortfall: number;
+    affordable: boolean;
+    reachableNow: number;
+    shortfallKobo: number;
+    autoTopUp: {
+        enabled: boolean;
+        wouldCover: boolean;
+        creditsPerTopUp: number;
+    };
+}
+export interface AutoTopUpSettings {
+    enabled: boolean;
+    threshold: number;
+    credits: number;
+    amountKobo: number;
+    paymentMethodId: string | null;
+    monthlyCapKobo: number | null;
+    spentThisMonthKobo: number;
+    spendable: number;
+    belowThreshold: boolean;
+    pausedUntil: string | null;
+    failureCount: number;
+    lastError: string | null;
+    /**
+     * Why nothing will happen, if nothing will happen. "Enabled" on its own is
+     * a lie when the card has been declining since Tuesday.
+     */
+    blockedReason: 'disabled' | 'no_payment_method' | 'paused_after_failure' | 'monthly_cap_reached' | null;
+}
+export interface SeatUsage {
+    used: number;
+    /** null means the plan does not cap seats. */
+    limit: number | null;
+    remaining: number | null;
+    planName: string | null;
+    atLimit: boolean;
+}
+export declare const creditsApi: {
+    summary: (tenantSlug: string) => Promise<CreditSummary>;
+    quote: (tenantSlug: string, body: {
+        recipients: number;
+        channel: MessagingChannel;
+        category?: MessageCategory;
+    }) => Promise<CampaignQuote>;
+    getAutoTopUp: (tenantSlug: string) => Promise<AutoTopUpSettings>;
+    updateAutoTopUp: (tenantSlug: string, body: {
+        enabled?: boolean;
+        threshold?: number;
+        credits?: number;
+        paymentMethodId?: string | null;
+        monthlyCapKobo?: number | null;
+    }) => Promise<AutoTopUpSettings>;
+    seats: (tenantSlug: string) => Promise<SeatUsage>;
+};

package/dist/api/credits.js

@@ -0,0 +1,24 @@
+import { apiFetch } from "./core";
+const creditsApi = {
+  summary: (tenantSlug) => apiFetch("/communications/messaging-credits/summary", {
+    tenantSlug
+  }),
+  quote: (tenantSlug, body) => apiFetch("/communications/messaging-credits/quote", {
+    method: "POST",
+    body: JSON.stringify(body),
+    tenantSlug
+  }),
+  getAutoTopUp: (tenantSlug) => apiFetch(
+    "/communications/messaging-credits/auto-top-up",
+    { tenantSlug }
+  ),
+  updateAutoTopUp: (tenantSlug, body) => apiFetch(
+    "/communications/messaging-credits/auto-top-up",
+    { method: "PATCH", body: JSON.stringify(body), tenantSlug }
+  ),
+  seats: (tenantSlug) => apiFetch("/team/seats", { tenantSlug })
+};
+export {
+  creditsApi
+};
+//# sourceMappingURL=credits.js.map

package/dist/api/credits.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/credits.ts"],"sourcesContent":["import { apiFetch } from './core';\n\nexport type MessagingChannel = 'sms' | 'whatsapp';\nexport type MessageCategory =\n  | 'marketing'\n  | 'utility'\n  | 'authentication'\n  | 'service';\n\n/**\n * One grant of credits.\n *\n * Credits used to be a single number, which could not say where any of it came\n * from or when it goes away. A block can: a plan allowance carries an expiry,\n * purchased credits do not, and the two are spent soonest-expiry first.\n */\nexport interface CreditBlock {\n  id: string;\n  source: 'purchase' | 'plan' | 'bonus' | 'migration' | 'adjustment';\n  amount: number;\n  remaining: number;\n  unitPriceKobo: number;\n  expiresAt: string | null;\n  grantedAt: string;\n  description: string | null;\n}\n\nexport interface CreditSummary {\n  spendable: number;\n  /** Money taken for credits not yet spent. Box's liability, not revenue. */\n  deferredRevenueKobo: number;\n  expiringSoon: { credits: number; at: string | null };\n  blocks: CreditBlock[];\n}\n\n/**\n * Whether a send can finish, asked before it starts.\n *\n * `reachableNow` is the number that matters when a balance is short: not\n * \"insufficient\" but \"this reaches 40 of your 100 people\".\n */\nexport interface CampaignQuote {\n  recipients: number;\n  channel: MessagingChannel;\n  category: MessageCategory;\n  creditsPerMessage: number;\n  creditsRequired: number;\n  creditsAvailable: number;\n  shortfall: number;\n  affordable: boolean;\n  reachableNow: number;\n  shortfallKobo: number;\n  autoTopUp: {\n    enabled: boolean;\n    wouldCover: boolean;\n    creditsPerTopUp: number;\n  };\n}\n\nexport interface AutoTopUpSettings {\n  enabled: boolean;\n  threshold: number;\n  credits: number;\n  amountKobo: number;\n  paymentMethodId: string | null;\n  monthlyCapKobo: number | null;\n  spentThisMonthKobo: number;\n  spendable: number;\n  belowThreshold: boolean;\n  pausedUntil: string | null;\n  failureCount: number;\n  lastError: string | null;\n  /**\n   * Why nothing will happen, if nothing will happen. \"Enabled\" on its own is\n   * a lie when the card has been declining since Tuesday.\n   */\n  blockedReason:\n    | 'disabled'\n    | 'no_payment_method'\n    | 'paused_after_failure'\n    | 'monthly_cap_reached'\n    | null;\n}\n\nexport interface SeatUsage {\n  used: number;\n  /** null means the plan does not cap seats. */\n  limit: number | null;\n  remaining: number | null;\n  planName: string | null;\n  atLimit: boolean;\n}\n\nexport const creditsApi = {\n  summary: (tenantSlug: string) =>\n    apiFetch<CreditSummary>('/communications/messaging-credits/summary', {\n      tenantSlug,\n    }),\n\n  quote: (\n    tenantSlug: string,\n    body: {\n      recipients: number;\n      channel: MessagingChannel;\n      category?: MessageCategory;\n    },\n  ) =>\n    apiFetch<CampaignQuote>('/communications/messaging-credits/quote', {\n      method: 'POST',\n      body: JSON.stringify(body),\n      tenantSlug,\n    }),\n\n  getAutoTopUp: (tenantSlug: string) =>\n    apiFetch<AutoTopUpSettings>(\n      '/communications/messaging-credits/auto-top-up',\n      { tenantSlug },\n    ),\n\n  updateAutoTopUp: (\n    tenantSlug: string,\n    body: {\n      enabled?: boolean;\n      threshold?: number;\n      credits?: number;\n      paymentMethodId?: string | null;\n      monthlyCapKobo?: number | null;\n    },\n  ) =>\n    apiFetch<AutoTopUpSettings>(\n      '/communications/messaging-credits/auto-top-up',\n      { method: 'PATCH', body: JSON.stringify(body), tenantSlug },\n    ),\n\n  seats: (tenantSlug: string) =>\n    apiFetch<SeatUsage>('/team/seats', { tenantSlug }),\n};\n"],"mappings":"AAAA,SAAS,gBAAgB;AA6FlB,MAAM,aAAa;AAAA,EACxB,SAAS,CAAC,eACR,SAAwB,6CAA6C;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAEH,OAAO,CACL,YACA,SAMA,SAAwB,2CAA2C;AAAA,IACjE,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB;AAAA,EACF,CAAC;AAAA,EAEH,cAAc,CAAC,eACb;AAAA,IACE;AAAA,IACA,EAAE,WAAW;AAAA,EACf;AAAA,EAEF,iBAAiB,CACf,YACA,SAQA;AAAA,IACE;AAAA,IACA,EAAE,QAAQ,SAAS,MAAM,KAAK,UAAU,IAAI,GAAG,WAAW;AAAA,EAC5D;AAAA,EAEF,OAAO,CAAC,eACN,SAAoB,eAAe,EAAE,WAAW,CAAC;AACrD;","names":[]}

package/dist/api/crm-analytics.d.ts

@@ -0,0 +1,10 @@
+import type { CustomerOverview, AcquisitionDataPoint, RetentionMetrics, LtvDistribution } from './types';
+export declare const crmAnalyticsApi: {
+    getOverview: (tenantSlug: string, range?: {
+        startDate: string;
+        endDate: string;
+    }) => Promise<CustomerOverview>;
+    getAcquisition: (tenantSlug: string, period?: "daily" | "weekly" | "monthly", months?: number) => Promise<AcquisitionDataPoint[]>;
+    getRetention: (tenantSlug: string) => Promise<RetentionMetrics>;
+    getLifetimeValue: (tenantSlug: string) => Promise<LtvDistribution>;
+};

package/dist/api/crm-analytics.js

@@ -0,0 +1,22 @@
+import { apiFetch } from "./core";
+const crmAnalyticsApi = {
+  // The period is optional and the endpoint answers without it, but every
+  // caller inside the analytics hub passes one: the hub renders a period label
+  // over these numbers, and unscoped they would silently be all-time.
+  getOverview: (tenantSlug, range) => apiFetch(
+    range ? `/crm/analytics/overview?startDate=${encodeURIComponent(range.startDate)}&endDate=${encodeURIComponent(range.endDate)}` : "/crm/analytics/overview",
+    { tenantSlug }
+  ),
+  getAcquisition: (tenantSlug, period = "monthly", months = 12) => apiFetch(
+    `/crm/analytics/acquisition?period=${period}&months=${months}`,
+    {
+      tenantSlug
+    }
+  ),
+  getRetention: (tenantSlug) => apiFetch("/crm/analytics/retention", { tenantSlug }),
+  getLifetimeValue: (tenantSlug) => apiFetch("/crm/analytics/lifetime-value", { tenantSlug })
+};
+export {
+  crmAnalyticsApi
+};
+//# sourceMappingURL=crm-analytics.js.map

package/dist/api/crm-analytics.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/crm-analytics.ts"],"sourcesContent":["import { apiFetch } from './core';\nimport type {\n  CustomerOverview,\n  AcquisitionDataPoint,\n  RetentionMetrics,\n  LtvDistribution,\n} from './types';\n\n// CRM Analytics API\n\nexport const crmAnalyticsApi = {\n  // The period is optional and the endpoint answers without it, but every\n  // caller inside the analytics hub passes one: the hub renders a period label\n  // over these numbers, and unscoped they would silently be all-time.\n  getOverview: (\n    tenantSlug: string,\n    range?: { startDate: string; endDate: string },\n  ) =>\n    apiFetch<CustomerOverview>(\n      range\n        ? `/crm/analytics/overview?startDate=${encodeURIComponent(range.startDate)}&endDate=${encodeURIComponent(range.endDate)}`\n        : '/crm/analytics/overview',\n      { tenantSlug },\n    ),\n\n  getAcquisition: (\n    tenantSlug: string,\n    period: 'daily' | 'weekly' | 'monthly' = 'monthly',\n    months = 12,\n  ) =>\n    apiFetch<AcquisitionDataPoint[]>(\n      `/crm/analytics/acquisition?period=${period}&months=${months}`,\n      {\n        tenantSlug,\n      },\n    ),\n\n  getRetention: (tenantSlug: string) =>\n    apiFetch<RetentionMetrics>('/crm/analytics/retention', { tenantSlug }),\n\n  getLifetimeValue: (tenantSlug: string) =>\n    apiFetch<LtvDistribution>('/crm/analytics/lifetime-value', { tenantSlug }),\n};\n\n// CRM Communications API (bulk email to segment)\n"],"mappings":"AAAA,SAAS,gBAAgB;AAUlB,MAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA,EAI7B,aAAa,CACX,YACA,UAEA;AAAA,IACE,QACI,qCAAqC,mBAAmB,MAAM,SAAS,CAAC,YAAY,mBAAmB,MAAM,OAAO,CAAC,KACrH;AAAA,IACJ,EAAE,WAAW;AAAA,EACf;AAAA,EAEF,gBAAgB,CACd,YACA,SAAyC,WACzC,SAAS,OAET;AAAA,IACE,qCAAqC,MAAM,WAAW,MAAM;AAAA,IAC5D;AAAA,MACE;AAAA,IACF;AAAA,EACF;AAAA,EAEF,cAAc,CAAC,eACb,SAA2B,4BAA4B,EAAE,WAAW,CAAC;AAAA,EAEvE,kBAAkB,CAAC,eACjB,SAA0B,iCAAiC,EAAE,WAAW,CAAC;AAC7E;","names":[]}

package/dist/api/crm-segments.d.ts

@@ -0,0 +1,14 @@
+import type { SegmentFilters, CustomerSegment, CreateSegmentInput, UpdateSegmentInput, SegmentPreviewResult } from './types';
+export declare const crmSegmentsApi: {
+    list: (tenantSlug: string) => Promise<CustomerSegment[]>;
+    create: (tenantSlug: string, data: CreateSegmentInput) => Promise<CustomerSegment>;
+    getById: (tenantSlug: string, id: string) => Promise<CustomerSegment>;
+    update: (tenantSlug: string, id: string, data: UpdateSegmentInput) => Promise<CustomerSegment>;
+    delete: (tenantSlug: string, id: string) => Promise<void>;
+    getCustomers: (tenantSlug: string, id: string, page?: number, limit?: number) => Promise<SegmentPreviewResult>;
+    preview: (tenantSlug: string, filters: SegmentFilters, page?: number, limit?: number) => Promise<SegmentPreviewResult>;
+    refreshCounts: (tenantSlug: string) => Promise<{
+        total: number;
+        updated: number;
+    }>;
+};

package/dist/api/crm-segments.js

@@ -0,0 +1,42 @@
+import { LIST_PAGE_SIZE } from "@withpotter/lib/list-page-size";
+import { apiFetch } from "./core";
+const crmSegmentsApi = {
+  list: (tenantSlug) => apiFetch("/crm/segments", { tenantSlug }),
+  create: (tenantSlug, data) => apiFetch("/crm/segments", {
+    method: "POST",
+    body: JSON.stringify(data),
+    tenantSlug
+  }),
+  getById: (tenantSlug, id) => apiFetch(`/crm/segments/${id}`, { tenantSlug }),
+  update: (tenantSlug, id, data) => apiFetch(`/crm/segments/${id}`, {
+    method: "PUT",
+    body: JSON.stringify(data),
+    tenantSlug
+  }),
+  delete: (tenantSlug, id) => apiFetch(`/crm/segments/${id}`, {
+    method: "DELETE",
+    tenantSlug
+  }),
+  getCustomers: (tenantSlug, id, page = 1, limit = LIST_PAGE_SIZE) => apiFetch(
+    `/crm/segments/${id}/customers?page=${page}&limit=${limit}`,
+    {
+      tenantSlug
+    }
+  ),
+  preview: (tenantSlug, filters, page = 1, limit = LIST_PAGE_SIZE) => apiFetch("/crm/segments/preview", {
+    method: "POST",
+    body: JSON.stringify({ filters, page, limit }),
+    tenantSlug
+  }),
+  refreshCounts: (tenantSlug) => apiFetch(
+    "/crm/segments/refresh-counts",
+    {
+      method: "POST",
+      tenantSlug
+    }
+  )
+};
+export {
+  crmSegmentsApi
+};
+//# sourceMappingURL=crm-segments.js.map

package/dist/api/crm-segments.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/crm-segments.ts"],"sourcesContent":["import { LIST_PAGE_SIZE } from '@withpotter/lib/list-page-size';\nimport { apiFetch } from './core';\nimport type {\n  SegmentFilters,\n  CustomerSegment,\n  CreateSegmentInput,\n  UpdateSegmentInput,\n  SegmentPreviewResult,\n} from './types';\n\n// CRM Segments API\n\nexport const crmSegmentsApi = {\n  list: (tenantSlug: string) =>\n    apiFetch<CustomerSegment[]>('/crm/segments', { tenantSlug }),\n\n  create: (tenantSlug: string, data: CreateSegmentInput) =>\n    apiFetch<CustomerSegment>('/crm/segments', {\n      method: 'POST',\n      body: JSON.stringify(data),\n      tenantSlug,\n    }),\n\n  getById: (tenantSlug: string, id: string) =>\n    apiFetch<CustomerSegment>(`/crm/segments/${id}`, { tenantSlug }),\n\n  update: (tenantSlug: string, id: string, data: UpdateSegmentInput) =>\n    apiFetch<CustomerSegment>(`/crm/segments/${id}`, {\n      method: 'PUT',\n      body: JSON.stringify(data),\n      tenantSlug,\n    }),\n\n  delete: (tenantSlug: string, id: string) =>\n    apiFetch<void>(`/crm/segments/${id}`, {\n      method: 'DELETE',\n      tenantSlug,\n    }),\n\n  getCustomers: (\n    tenantSlug: string,\n    id: string,\n    page = 1,\n    limit = LIST_PAGE_SIZE,\n  ) =>\n    apiFetch<SegmentPreviewResult>(\n      `/crm/segments/${id}/customers?page=${page}&limit=${limit}`,\n      {\n        tenantSlug,\n      },\n    ),\n\n  preview: (\n    tenantSlug: string,\n    filters: SegmentFilters,\n    page = 1,\n    limit = LIST_PAGE_SIZE,\n  ) =>\n    apiFetch<SegmentPreviewResult>('/crm/segments/preview', {\n      method: 'POST',\n      body: JSON.stringify({ filters, page, limit }),\n      tenantSlug,\n    }),\n\n  refreshCounts: (tenantSlug: string) =>\n    apiFetch<{ total: number; updated: number }>(\n      '/crm/segments/refresh-counts',\n      {\n        method: 'POST',\n        tenantSlug,\n      },\n    ),\n};\n\n// CRM Analytics API\n"],"mappings":"AAAA,SAAS,sBAAsB;AAC/B,SAAS,gBAAgB;AAWlB,MAAM,iBAAiB;AAAA,EAC5B,MAAM,CAAC,eACL,SAA4B,iBAAiB,EAAE,WAAW,CAAC;AAAA,EAE7D,QAAQ,CAAC,YAAoB,SAC3B,SAA0B,iBAAiB;AAAA,IACzC,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB;AAAA,EACF,CAAC;AAAA,EAEH,SAAS,CAAC,YAAoB,OAC5B,SAA0B,iBAAiB,EAAE,IAAI,EAAE,WAAW,CAAC;AAAA,EAEjE,QAAQ,CAAC,YAAoB,IAAY,SACvC,SAA0B,iBAAiB,EAAE,IAAI;AAAA,IAC/C,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,IAAI;AAAA,IACzB;AAAA,EACF,CAAC;AAAA,EAEH,QAAQ,CAAC,YAAoB,OAC3B,SAAe,iBAAiB,EAAE,IAAI;AAAA,IACpC,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA,EAEH,cAAc,CACZ,YACA,IACA,OAAO,GACP,QAAQ,mBAER;AAAA,IACE,iBAAiB,EAAE,mBAAmB,IAAI,UAAU,KAAK;AAAA,IACzD;AAAA,MACE;AAAA,IACF;AAAA,EACF;AAAA,EAEF,SAAS,CACP,YACA,SACA,OAAO,GACP,QAAQ,mBAER,SAA+B,yBAAyB;AAAA,IACtD,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,EAAE,SAAS,MAAM,MAAM,CAAC;AAAA,IAC7C;AAAA,EACF,CAAC;AAAA,EAEH,eAAe,CAAC,eACd;AAAA,IACE;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACJ;","names":[]}