@withpotter/lib 0.13.0-next.101

package/dist/api/potter.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Box's answering route — the model, not the regex.
+ *
+ * `potter-answer.ts` is still here and still answers when this cannot: a
+ * keyword router over a help corpus that reaches four hand-written lookups. It
+ * could only ever answer sentences somebody had already thought of, which is
+ * why "which items are running low" matched and "am I about to run out of
+ * anything" did not.
+ *
+ * This calls `POST /potter/ask`, which decides which question a sentence IS,
+ * in whatever words it arrived in, and answers from the merchant's own rows
+ * through the same usecases the analytics screens read.
+ */
+export interface PotterTurn {
+    role: 'you' | 'potter';
+    text: string;
+}
+export interface PotterAnswer {
+    text: string;
+    /** Which lookups ran. Nothing renders this yet; it is here so an answer can
+     *  be audited against the rows it claims to have read. */
+    toolsUsed: string[];
+}
+/**
+ * NULL MEANS "NOT AVAILABLE", NOT "NO ANSWER", and the caller must tell those
+ * apart. The route answers 503 wherever `ANTHROPIC_API_KEY` is unset — which is
+ * every local checkout and staging until the key is deployed — and a merchant
+ * must not see an error for a deployment state they cannot act on. The caller
+ * falls back to the local router, which is exactly what shipped before this
+ * existed.
+ *
+ * A thrown error is different and is NOT swallowed here: a 500 from a route
+ * that is configured is a real failure and the surface should say so.
+ */
+export declare const potterApi: {
+    /**
+     * `tenantSlug` IS NOT OPTIONAL IN PRACTICE, and leaving it off is what broke
+     * this route. `/potter/ask` reads `@TenantId()` behind `PermissionsGuard`,
+     * which throws `Tenant context required` — a 401 — when no workspace was
+     * named. `apiFetch` only sends `X-Tenant-Slug` when it is handed one, so
+     * every question from the browser took a 401, which is not 503 and so was
+     * rethrown rather than falling back. The surface said "I could not reach
+     * that just now. Try again in a moment.", which was untrue in the only way
+     * that matters: trying again could never work.
+     */
+    ask(question: string, history?: PotterTurn[], tenantSlug?: string): Promise<PotterAnswer | null>;
+};
+/** One frame of a streamed turn, mirroring the API's own union. */
+export type PotterStreamEvent = {
+    type: 'text';
+    text: string;
+} | {
+    type: 'tool';
+    name: string;
+} | {
+    type: 'done';
+    toolsUsed: string[];
+} | {
+    type: 'error';
+    message: string;
+};
+/**
+ * The same answer, read as it is written.
+ *
+ * NOT `EventSource`, and not because of a preference: it only speaks GET, and a
+ * question plus ten turns of history does not belong in a URL. So this posts and
+ * reads the body stream, which is a few lines of framing here and nothing at all
+ * on the server.
+ *
+ * SSE FRAMING IS LINE-ORIENTED AND A CHUNK IS NOT A FRAME. A read can end
+ * mid-event, so the tail of the buffer is kept until a blank line proves the
+ * frame is whole. Parsing per chunk instead is the bug that shows up only under
+ * load, when messages are long enough to split.
+ *
+ * FALSE MEANS "NOT AVAILABLE HERE", the same contract `ask` uses: an
+ * unconfigured environment cannot answer 503 once the headers are out, so it
+ * says so in an `error` frame instead, and both paths return the caller to the
+ * keyword router rather than to an error a merchant cannot act on.
+ */
+/**
+ * A RAW `fetch` HAS TO CARRY WHAT `apiFetch` WOULD HAVE CARRIED.
+ *
+ * This posted `Content-Type` and nothing else, and a body stream is the one
+ * thing `apiFetch` cannot return — so the route lost the four headers every
+ * other call in the app gets for free. Two of them were load-bearing:
+ * `X-CSRF-Token`, without which the api's global `CsrfGuard` refuses every
+ * POST, and `X-Tenant-Slug`, without which `PermissionsGuard` has no workspace
+ * to check a permission against. The stream therefore answered 403 on every
+ * environment since it shipped, silently, because a failed stream falls back
+ * to the whole-turn route and that route was broken the same way.
+ *
+ * They are read off the same helpers `apiFetch` uses rather than passed in, so
+ * the two paths cannot drift on where a token lives.
+ */
+export declare function askPotterStream(question: string, history: PotterTurn[], on: (event: PotterStreamEvent) => void, signal?: AbortSignal, tenantSlug?: string): Promise<boolean>;
+/**
+ * Whole SSE events out of a buffer, and whatever is left over.
+ *
+ * SEPARATED FROM THE FETCH SO IT CAN BE TESTED, because this is the part that
+ * is quietly wrong in most hand-rolled SSE clients and the part that cannot be
+ * checked by looking at it. A chunk is not a frame: a read can end anywhere,
+ * including halfway through a JSON payload, so anything after the last blank
+ * line is held back rather than parsed. Parsing per chunk works perfectly until
+ * answers get long enough to split across reads — which is exactly when nobody
+ * is watching.
+ *
+ * A frame that is not JSON is dropped rather than thrown: that is a proxy or a
+ * gateway talking, not Box, and crashing a merchant's turn on somebody
+ * else's error page helps nobody.
+ */
+export declare function takeSseEvents(buffer: string): {
+    events: PotterStreamEvent[];
+    rest: string;
+};

package/dist/api/potter.js

@@ -0,0 +1,88 @@
+import { apiFetch, getAccountId, getCsrfToken } from "./core";
+const potterApi = {
+  /**
+   * `tenantSlug` IS NOT OPTIONAL IN PRACTICE, and leaving it off is what broke
+   * this route. `/potter/ask` reads `@TenantId()` behind `PermissionsGuard`,
+   * which throws `Tenant context required` — a 401 — when no workspace was
+   * named. `apiFetch` only sends `X-Tenant-Slug` when it is handed one, so
+   * every question from the browser took a 401, which is not 503 and so was
+   * rethrown rather than falling back. The surface said "I could not reach
+   * that just now. Try again in a moment.", which was untrue in the only way
+   * that matters: trying again could never work.
+   */
+  async ask(question, history = [], tenantSlug) {
+    try {
+      return await apiFetch("/potter/ask", {
+        method: "POST",
+        tenantSlug,
+        body: JSON.stringify({ question, history })
+      });
+    } catch (err) {
+      const status = err?.status;
+      if (status === 503 || status === 404) return null;
+      throw err;
+    }
+  }
+};
+async function askPotterStream(question, history, on, signal, tenantSlug) {
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (tenantSlug) headers["X-Tenant-Slug"] = tenantSlug;
+  const accountId = getAccountId();
+  if (accountId) headers["x-account-id"] = accountId;
+  const csrfToken = getCsrfToken();
+  if (csrfToken) headers["X-CSRF-Token"] = csrfToken;
+  const res = await fetch("/api/proxy/potter/ask/stream", {
+    method: "POST",
+    headers,
+    credentials: "include",
+    body: JSON.stringify({ question, history }),
+    signal
+  });
+  if (res.status === 503 || res.status === 404 || !res.body) return false;
+  if (!res.ok) throw new Error(`Box answered ${res.status}`);
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let available = true;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const { events, rest } = takeSseEvents(
+      buffer + decoder.decode(value, { stream: true })
+    );
+    buffer = rest;
+    for (const event of events) {
+      if (event.type === "error" && event.message.includes("not configured")) {
+        available = false;
+      } else {
+        on(event);
+      }
+    }
+  }
+  return available;
+}
+function takeSseEvents(buffer) {
+  const events = [];
+  let rest = buffer;
+  for (; ; ) {
+    const cut = rest.indexOf("\n\n");
+    if (cut === -1) break;
+    const frame = rest.slice(0, cut);
+    rest = rest.slice(cut + 2);
+    const line = frame.split("\n").find((l) => l.startsWith("data:"));
+    if (!line) continue;
+    try {
+      events.push(JSON.parse(line.slice(5).trim()));
+    } catch {
+    }
+  }
+  return { events, rest };
+}
+export {
+  askPotterStream,
+  potterApi,
+  takeSseEvents
+};
+//# sourceMappingURL=potter.js.map

package/dist/api/potter.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/potter.ts"],"sourcesContent":["import { apiFetch, getAccountId, getCsrfToken } from './core';\n\n/**\n * Box's answering route — the model, not the regex.\n *\n * `potter-answer.ts` is still here and still answers when this cannot: a\n * keyword router over a help corpus that reaches four hand-written lookups. It\n * could only ever answer sentences somebody had already thought of, which is\n * why \"which items are running low\" matched and \"am I about to run out of\n * anything\" did not.\n *\n * This calls `POST /potter/ask`, which decides which question a sentence IS,\n * in whatever words it arrived in, and answers from the merchant's own rows\n * through the same usecases the analytics screens read.\n */\n\nexport interface PotterTurn {\n  role: 'you' | 'potter';\n  text: string;\n}\n\nexport interface PotterAnswer {\n  text: string;\n  /** Which lookups ran. Nothing renders this yet; it is here so an answer can\n   *  be audited against the rows it claims to have read. */\n  toolsUsed: string[];\n}\n\n/**\n * NULL MEANS \"NOT AVAILABLE\", NOT \"NO ANSWER\", and the caller must tell those\n * apart. The route answers 503 wherever `ANTHROPIC_API_KEY` is unset — which is\n * every local checkout and staging until the key is deployed — and a merchant\n * must not see an error for a deployment state they cannot act on. The caller\n * falls back to the local router, which is exactly what shipped before this\n * existed.\n *\n * A thrown error is different and is NOT swallowed here: a 500 from a route\n * that is configured is a real failure and the surface should say so.\n */\nexport const potterApi = {\n  /**\n   * `tenantSlug` IS NOT OPTIONAL IN PRACTICE, and leaving it off is what broke\n   * this route. `/potter/ask` reads `@TenantId()` behind `PermissionsGuard`,\n   * which throws `Tenant context required` — a 401 — when no workspace was\n   * named. `apiFetch` only sends `X-Tenant-Slug` when it is handed one, so\n   * every question from the browser took a 401, which is not 503 and so was\n   * rethrown rather than falling back. The surface said \"I could not reach\n   * that just now. Try again in a moment.\", which was untrue in the only way\n   * that matters: trying again could never work.\n   */\n  async ask(\n    question: string,\n    history: PotterTurn[] = [],\n    tenantSlug?: string,\n  ): Promise<PotterAnswer | null> {\n    try {\n      return await apiFetch<PotterAnswer>('/potter/ask', {\n        method: 'POST',\n        tenantSlug,\n        body: JSON.stringify({ question, history }),\n      });\n    } catch (err) {\n      const status = (err as { status?: number } | null)?.status;\n      // 503: not configured here. 404: the route is older than this client.\n      if (status === 503 || status === 404) return null;\n      throw err;\n    }\n  },\n};\n\n/** One frame of a streamed turn, mirroring the API's own union. */\nexport type PotterStreamEvent =\n  | { type: 'text'; text: string }\n  | { type: 'tool'; name: string }\n  | { type: 'done'; toolsUsed: string[] }\n  | { type: 'error'; message: string };\n\n/**\n * The same answer, read as it is written.\n *\n * NOT `EventSource`, and not because of a preference: it only speaks GET, and a\n * question plus ten turns of history does not belong in a URL. So this posts and\n * reads the body stream, which is a few lines of framing here and nothing at all\n * on the server.\n *\n * SSE FRAMING IS LINE-ORIENTED AND A CHUNK IS NOT A FRAME. A read can end\n * mid-event, so the tail of the buffer is kept until a blank line proves the\n * frame is whole. Parsing per chunk instead is the bug that shows up only under\n * load, when messages are long enough to split.\n *\n * FALSE MEANS \"NOT AVAILABLE HERE\", the same contract `ask` uses: an\n * unconfigured environment cannot answer 503 once the headers are out, so it\n * says so in an `error` frame instead, and both paths return the caller to the\n * keyword router rather than to an error a merchant cannot act on.\n */\n/**\n * A RAW `fetch` HAS TO CARRY WHAT `apiFetch` WOULD HAVE CARRIED.\n *\n * This posted `Content-Type` and nothing else, and a body stream is the one\n * thing `apiFetch` cannot return — so the route lost the four headers every\n * other call in the app gets for free. Two of them were load-bearing:\n * `X-CSRF-Token`, without which the api's global `CsrfGuard` refuses every\n * POST, and `X-Tenant-Slug`, without which `PermissionsGuard` has no workspace\n * to check a permission against. The stream therefore answered 403 on every\n * environment since it shipped, silently, because a failed stream falls back\n * to the whole-turn route and that route was broken the same way.\n *\n * They are read off the same helpers `apiFetch` uses rather than passed in, so\n * the two paths cannot drift on where a token lives.\n */\nexport async function askPotterStream(\n  question: string,\n  history: PotterTurn[],\n  on: (event: PotterStreamEvent) => void,\n  signal?: AbortSignal,\n  tenantSlug?: string,\n): Promise<boolean> {\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n  };\n  if (tenantSlug) headers['X-Tenant-Slug'] = tenantSlug;\n  const accountId = getAccountId();\n  if (accountId) headers['x-account-id'] = accountId;\n  const csrfToken = getCsrfToken();\n  if (csrfToken) headers['X-CSRF-Token'] = csrfToken;\n\n  const res = await fetch('/api/proxy/potter/ask/stream', {\n    method: 'POST',\n    headers,\n    credentials: 'include',\n    body: JSON.stringify({ question, history }),\n    signal,\n  });\n\n  if (res.status === 503 || res.status === 404 || !res.body) return false;\n  if (!res.ok) throw new Error(`Box answered ${res.status}`);\n\n  const reader = res.body.getReader();\n  const decoder = new TextDecoder();\n  let buffer = '';\n  let available = true;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n\n    const { events, rest } = takeSseEvents(\n      buffer + decoder.decode(value, { stream: true }),\n    );\n    buffer = rest;\n\n    for (const event of events) {\n      /* An unconfigured environment says so in-band, because a 503 cannot be\n         sent once the headers are out. Treated as \"not available\" rather than\n         as a failure, so the caller falls back exactly as it would on a 503. */\n      if (event.type === 'error' && event.message.includes('not configured')) {\n        available = false;\n      } else {\n        on(event);\n      }\n    }\n  }\n\n  return available;\n}\n\n/**\n * Whole SSE events out of a buffer, and whatever is left over.\n *\n * SEPARATED FROM THE FETCH SO IT CAN BE TESTED, because this is the part that\n * is quietly wrong in most hand-rolled SSE clients and the part that cannot be\n * checked by looking at it. A chunk is not a frame: a read can end anywhere,\n * including halfway through a JSON payload, so anything after the last blank\n * line is held back rather than parsed. Parsing per chunk works perfectly until\n * answers get long enough to split across reads — which is exactly when nobody\n * is watching.\n *\n * A frame that is not JSON is dropped rather than thrown: that is a proxy or a\n * gateway talking, not Box, and crashing a merchant's turn on somebody\n * else's error page helps nobody.\n */\nexport function takeSseEvents(buffer: string): {\n  events: PotterStreamEvent[];\n  rest: string;\n} {\n  const events: PotterStreamEvent[] = [];\n  let rest = buffer;\n\n  for (;;) {\n    const cut = rest.indexOf('\\n\\n');\n    if (cut === -1) break;\n\n    const frame = rest.slice(0, cut);\n    rest = rest.slice(cut + 2);\n\n    const line = frame.split('\\n').find((l) => l.startsWith('data:'));\n    if (!line) continue;\n\n    try {\n      events.push(JSON.parse(line.slice(5).trim()) as PotterStreamEvent);\n    } catch {\n      /* Not ours. See above. */\n    }\n  }\n\n  return { events, rest };\n}\n"],"mappings":"AAAA,SAAS,UAAU,cAAc,oBAAoB;AAuC9C,MAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWvB,MAAM,IACJ,UACA,UAAwB,CAAC,GACzB,YAC8B;AAC9B,QAAI;AACF,aAAO,MAAM,SAAuB,eAAe;AAAA,QACjD,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,UAAU,QAAQ,CAAC;AAAA,MAC5C,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAU,KAAoC;AAEpD,UAAI,WAAW,OAAO,WAAW,IAAK,QAAO;AAC7C,YAAM;AAAA,IACR;AAAA,EACF;AACF;AA0CA,eAAsB,gBACpB,UACA,SACA,IACA,QACA,YACkB;AAClB,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,EAClB;AACA,MAAI,WAAY,SAAQ,eAAe,IAAI;AAC3C,QAAM,YAAY,aAAa;AAC/B,MAAI,UAAW,SAAQ,cAAc,IAAI;AACzC,QAAM,YAAY,aAAa;AAC/B,MAAI,UAAW,SAAQ,cAAc,IAAI;AAEzC,QAAM,MAAM,MAAM,MAAM,gCAAgC;AAAA,IACtD,QAAQ;AAAA,IACR;AAAA,IACA,aAAa;AAAA,IACb,MAAM,KAAK,UAAU,EAAE,UAAU,QAAQ,CAAC;AAAA,IAC1C;AAAA,EACF,CAAC;AAED,MAAI,IAAI,WAAW,OAAO,IAAI,WAAW,OAAO,CAAC,IAAI,KAAM,QAAO;AAClE,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,gBAAgB,IAAI,MAAM,EAAE;AAEzD,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,SAAS;AACb,MAAI,YAAY;AAEhB,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AAEV,UAAM,EAAE,QAAQ,KAAK,IAAI;AAAA,MACvB,SAAS,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,IACjD;AACA,aAAS;AAET,eAAW,SAAS,QAAQ;AAI1B,UAAI,MAAM,SAAS,WAAW,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,oBAAY;AAAA,MACd,OAAO;AACL,WAAG,KAAK;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAiBO,SAAS,cAAc,QAG5B;AACA,QAAM,SAA8B,CAAC;AACrC,MAAI,OAAO;AAEX,aAAS;AACP,UAAM,MAAM,KAAK,QAAQ,MAAM;AAC/B,QAAI,QAAQ,GAAI;AAEhB,UAAM,QAAQ,KAAK,MAAM,GAAG,GAAG;AAC/B,WAAO,KAAK,MAAM,MAAM,CAAC;AAEzB,UAAM,OAAO,MAAM,MAAM,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO,CAAC;AAChE,QAAI,CAAC,KAAM;AAEX,QAAI;AACF,aAAO,KAAK,KAAK,MAAM,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,CAAsB;AAAA,IACnE,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,KAAK;AACxB;","names":[]}

package/dist/api/push.d.ts

@@ -0,0 +1,25 @@
+export interface PushPublicKey {
+    /** Null when the environment has no VAPID keys configured. */
+    publicKey: string | null;
+}
+/**
+ * Web Push registration.
+ *
+ * The browser owns the subscription object; this only tells the API where to
+ * send. `subscribe` is safe to call repeatedly — the API upserts on endpoint,
+ * because a browser re-permissioned after a reset returns the same endpoint
+ * with fresh keys and must not become a second row that buzzes the phone twice.
+ */
+export declare const pushApi: {
+    getPublicKey: (tenantSlug: string) => Promise<PushPublicKey>;
+    subscribe: (tenantSlug: string, subscription: PushSubscriptionJSON) => Promise<{
+        id: string;
+    }>;
+    unsubscribe: (tenantSlug: string, endpoint: string) => Promise<{
+        removed: number;
+    }>;
+    /** Proves the permission works, so turning it on is not an act of faith. */
+    sendTest: (tenantSlug: string) => Promise<{
+        delivered: number;
+    }>;
+};

package/dist/api/push.js

@@ -0,0 +1,23 @@
+import { apiFetch } from "./core";
+const pushApi = {
+  getPublicKey: (tenantSlug) => apiFetch("/communications/push/public-key", { tenantSlug }),
+  subscribe: (tenantSlug, subscription) => apiFetch("/communications/push/subscribe", {
+    tenantSlug,
+    method: "POST",
+    body: JSON.stringify(subscription)
+  }),
+  unsubscribe: (tenantSlug, endpoint) => apiFetch("/communications/push/subscribe", {
+    tenantSlug,
+    method: "DELETE",
+    body: JSON.stringify({ endpoint })
+  }),
+  /** Proves the permission works, so turning it on is not an act of faith. */
+  sendTest: (tenantSlug) => apiFetch("/communications/push/test", {
+    tenantSlug,
+    method: "POST"
+  })
+};
+export {
+  pushApi
+};
+//# sourceMappingURL=push.js.map

package/dist/api/push.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/push.ts"],"sourcesContent":["import { apiFetch } from './core';\n\nexport interface PushPublicKey {\n  /** Null when the environment has no VAPID keys configured. */\n  publicKey: string | null;\n}\n\n/**\n * Web Push registration.\n *\n * The browser owns the subscription object; this only tells the API where to\n * send. `subscribe` is safe to call repeatedly — the API upserts on endpoint,\n * because a browser re-permissioned after a reset returns the same endpoint\n * with fresh keys and must not become a second row that buzzes the phone twice.\n */\nexport const pushApi = {\n  getPublicKey: (tenantSlug: string) =>\n    apiFetch<PushPublicKey>('/communications/push/public-key', { tenantSlug }),\n\n  subscribe: (tenantSlug: string, subscription: PushSubscriptionJSON) =>\n    apiFetch<{ id: string }>('/communications/push/subscribe', {\n      tenantSlug,\n      method: 'POST',\n      body: JSON.stringify(subscription),\n    }),\n\n  unsubscribe: (tenantSlug: string, endpoint: string) =>\n    apiFetch<{ removed: number }>('/communications/push/subscribe', {\n      tenantSlug,\n      method: 'DELETE',\n      body: JSON.stringify({ endpoint }),\n    }),\n\n  /** Proves the permission works, so turning it on is not an act of faith. */\n  sendTest: (tenantSlug: string) =>\n    apiFetch<{ delivered: number }>('/communications/push/test', {\n      tenantSlug,\n      method: 'POST',\n    }),\n};\n"],"mappings":"AAAA,SAAS,gBAAgB;AAelB,MAAM,UAAU;AAAA,EACrB,cAAc,CAAC,eACb,SAAwB,mCAAmC,EAAE,WAAW,CAAC;AAAA,EAE3E,WAAW,CAAC,YAAoB,iBAC9B,SAAyB,kCAAkC;AAAA,IACzD;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,YAAY;AAAA,EACnC,CAAC;AAAA,EAEH,aAAa,CAAC,YAAoB,aAChC,SAA8B,kCAAkC;AAAA,IAC9D;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,EACnC,CAAC;AAAA;AAAA,EAGH,UAAU,CAAC,eACT,SAAgC,6BAA6B;AAAA,IAC3D;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AACL;","names":[]}

package/dist/api/referrals.d.ts

@@ -0,0 +1,10 @@
+import type { ReferralStatus, PaginatedReferrals, ReferralStats } from './types';
+export declare const referralsApi: {
+    list: (tenantSlug: string, query?: {
+        status?: ReferralStatus;
+        referrerMemberId?: string;
+        page?: number;
+        limit?: number;
+    }) => Promise<PaginatedReferrals>;
+    getStats: (tenantSlug: string) => Promise<ReferralStats>;
+};

package/dist/api/referrals.js

@@ -0,0 +1,16 @@
+import { apiFetch } from "./core";
+const referralsApi = {
+  list: (tenantSlug, query) => apiFetch(
+    `/referrals?${new URLSearchParams(
+      Object.fromEntries(
+        Object.entries(query || {}).filter(([, v]) => v != null).map(([k, v]) => [k, String(v)])
+      )
+    )}`,
+    { tenantSlug }
+  ),
+  getStats: (tenantSlug) => apiFetch("/referrals/stats", { tenantSlug })
+};
+export {
+  referralsApi
+};
+//# sourceMappingURL=referrals.js.map

package/dist/api/referrals.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/referrals.ts"],"sourcesContent":["import { apiFetch } from './core';\nimport type {\n  ReferralStatus,\n  PaginatedReferrals,\n  ReferralStats,\n} from './types';\n\nexport const referralsApi = {\n  list: (\n    tenantSlug: string,\n    query?: {\n      status?: ReferralStatus;\n      referrerMemberId?: string;\n      page?: number;\n      limit?: number;\n    },\n  ) =>\n    apiFetch<PaginatedReferrals>(\n      `/referrals?${new URLSearchParams(\n        Object.fromEntries(\n          Object.entries(query || {})\n            .filter(([, v]) => v != null)\n            .map(([k, v]) => [k, String(v)]),\n        ),\n      )}`,\n      { tenantSlug },\n    ),\n\n  getStats: (tenantSlug: string) =>\n    apiFetch<ReferralStats>('/referrals/stats', { tenantSlug }),\n};\n\n// =============================================================================\n// DISCOUNTS API\n// =============================================================================\n"],"mappings":"AAAA,SAAS,gBAAgB;AAOlB,MAAM,eAAe;AAAA,EAC1B,MAAM,CACJ,YACA,UAOA;AAAA,IACE,cAAc,IAAI;AAAA,MAChB,OAAO;AAAA,QACL,OAAO,QAAQ,SAAS,CAAC,CAAC,EACvB,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,EAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;AAAA,MACnC;AAAA,IACF,CAAC;AAAA,IACD,EAAE,WAAW;AAAA,EACf;AAAA,EAEF,UAAU,CAAC,eACT,SAAwB,oBAAoB,EAAE,WAAW,CAAC;AAC9D;","names":[]}

package/dist/api/resource-categories.d.ts

@@ -0,0 +1,35 @@
+export declare const resourceCategoriesApi: {
+    /**
+     * List all resource categories for the current tenant
+     */
+    list: (tenantSlug: string, kind?: import("../resource-types").ResourceCategoryKind) => Promise<import("../resource-types").ResourceCategory[]>;
+    /**
+     * Which services ask for each group.
+     *
+     * The reverse of `getContentRequirements`, and the roster's question rather
+     * than the service editor's: a group nothing asks for is never offered to a
+     * customer, so the people in it can never be booked. A group with no entry in
+     * the response is the answer "nothing does".
+     */
+    usage: (tenantSlug: string) => Promise<import("../resource-types").CategoryUsage[]>;
+    /**
+     * Create a new resource category
+     */
+    create: (tenantSlug: string, data: import("../resource-types").CreateResourceCategoryInput) => Promise<import("../resource-types").ResourceCategory>;
+    /**
+     * Update a resource category
+     */
+    update: (tenantSlug: string, id: string, data: import("../resource-types").UpdateResourceCategoryInput) => Promise<import("../resource-types").ResourceCategory>;
+    /**
+     * Delete a resource category
+     */
+    delete: (tenantSlug: string, id: string) => Promise<void>;
+    /**
+     * Set resource requirements for a product/service
+     */
+    setContentRequirements: (tenantSlug: string, contentId: string, data: import("../resource-types").SetContentRequirementsInput) => Promise<import("../resource-types").ContentResourceRequirement[]>;
+    /**
+     * Get resource requirements for a product/service
+     */
+    getContentRequirements: (tenantSlug: string, contentId: string) => Promise<import("../resource-types").ContentResourceRequirement[]>;
+};

package/dist/api/resource-categories.js

@@ -0,0 +1,76 @@
+import { apiFetch } from "./core";
+const resourceCategoriesApi = {
+  /**
+   * List all resource categories for the current tenant
+   */
+  list: (tenantSlug, kind) => {
+    const query = kind ? `?kind=${kind}` : "";
+    return apiFetch(
+      `/resource-categories${query}`,
+      { tenantSlug }
+    );
+  },
+  /**
+   * Which services ask for each group.
+   *
+   * The reverse of `getContentRequirements`, and the roster's question rather
+   * than the service editor's: a group nothing asks for is never offered to a
+   * customer, so the people in it can never be booked. A group with no entry in
+   * the response is the answer "nothing does".
+   */
+  usage: (tenantSlug) => apiFetch(
+    "/resource-categories/usage",
+    { tenantSlug }
+  ),
+  /**
+   * Create a new resource category
+   */
+  create: (tenantSlug, data) => apiFetch(
+    "/resource-categories",
+    {
+      method: "POST",
+      tenantSlug,
+      body: JSON.stringify(data)
+    }
+  ),
+  /**
+   * Update a resource category
+   */
+  update: (tenantSlug, id, data) => apiFetch(
+    `/resource-categories/${id}`,
+    {
+      method: "PUT",
+      tenantSlug,
+      body: JSON.stringify(data)
+    }
+  ),
+  /**
+   * Delete a resource category
+   */
+  delete: (tenantSlug, id) => apiFetch(`/resource-categories/${id}`, {
+    method: "DELETE",
+    tenantSlug
+  }),
+  /**
+   * Set resource requirements for a product/service
+   */
+  setContentRequirements: (tenantSlug, contentId, data) => apiFetch(
+    `/resource-categories/content/${contentId}/requirements`,
+    {
+      method: "PUT",
+      tenantSlug,
+      body: JSON.stringify(data)
+    }
+  ),
+  /**
+   * Get resource requirements for a product/service
+   */
+  getContentRequirements: (tenantSlug, contentId) => apiFetch(
+    `/resource-categories/content/${contentId}/requirements`,
+    { tenantSlug }
+  )
+};
+export {
+  resourceCategoriesApi
+};
+//# sourceMappingURL=resource-categories.js.map

package/dist/api/resource-categories.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/resource-categories.ts"],"sourcesContent":["import { apiFetch } from './core';\n\n// ============================================\n// RESOURCE CATEGORIES API\n// ============================================\n\nexport const resourceCategoriesApi = {\n  /**\n   * List all resource categories for the current tenant\n   */\n  list: (\n    tenantSlug: string,\n    kind?: import('../resource-types').ResourceCategoryKind,\n  ) => {\n    const query = kind ? `?kind=${kind}` : '';\n    return apiFetch<import('../resource-types').ResourceCategory[]>(\n      `/resource-categories${query}`,\n      { tenantSlug },\n    );\n  },\n\n  /**\n   * Which services ask for each group.\n   *\n   * The reverse of `getContentRequirements`, and the roster's question rather\n   * than the service editor's: a group nothing asks for is never offered to a\n   * customer, so the people in it can never be booked. A group with no entry in\n   * the response is the answer \"nothing does\".\n   */\n  usage: (tenantSlug: string) =>\n    apiFetch<import('../resource-types').CategoryUsage[]>(\n      '/resource-categories/usage',\n      { tenantSlug },\n    ),\n\n  /**\n   * Create a new resource category\n   */\n  create: (\n    tenantSlug: string,\n    data: import('../resource-types').CreateResourceCategoryInput,\n  ) =>\n    apiFetch<import('../resource-types').ResourceCategory>(\n      '/resource-categories',\n      {\n        method: 'POST',\n        tenantSlug,\n        body: JSON.stringify(data),\n      },\n    ),\n\n  /**\n   * Update a resource category\n   */\n  update: (\n    tenantSlug: string,\n    id: string,\n    data: import('../resource-types').UpdateResourceCategoryInput,\n  ) =>\n    apiFetch<import('../resource-types').ResourceCategory>(\n      `/resource-categories/${id}`,\n      {\n        method: 'PUT',\n        tenantSlug,\n        body: JSON.stringify(data),\n      },\n    ),\n\n  /**\n   * Delete a resource category\n   */\n  delete: (tenantSlug: string, id: string) =>\n    apiFetch<void>(`/resource-categories/${id}`, {\n      method: 'DELETE',\n      tenantSlug,\n    }),\n\n  /**\n   * Set resource requirements for a product/service\n   */\n  setContentRequirements: (\n    tenantSlug: string,\n    contentId: string,\n    data: import('../resource-types').SetContentRequirementsInput,\n  ) =>\n    apiFetch<import('../resource-types').ContentResourceRequirement[]>(\n      `/resource-categories/content/${contentId}/requirements`,\n      {\n        method: 'PUT',\n        tenantSlug,\n        body: JSON.stringify(data),\n      },\n    ),\n\n  /**\n   * Get resource requirements for a product/service\n   */\n  getContentRequirements: (tenantSlug: string, contentId: string) =>\n    apiFetch<import('../resource-types').ContentResourceRequirement[]>(\n      `/resource-categories/content/${contentId}/requirements`,\n      { tenantSlug },\n    ),\n};\n\n// ============================================\n// WAITLIST API\n// ============================================\n"],"mappings":"AAAA,SAAS,gBAAgB;AAMlB,MAAM,wBAAwB;AAAA;AAAA;AAAA;AAAA,EAInC,MAAM,CACJ,YACA,SACG;AACH,UAAM,QAAQ,OAAO,SAAS,IAAI,KAAK;AACvC,WAAO;AAAA,MACL,uBAAuB,KAAK;AAAA,MAC5B,EAAE,WAAW;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,OAAO,CAAC,eACN;AAAA,IACE;AAAA,IACA,EAAE,WAAW;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKF,QAAQ,CACN,YACA,SAEA;AAAA,IACE;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKF,QAAQ,CACN,YACA,IACA,SAEA;AAAA,IACE,wBAAwB,EAAE;AAAA,IAC1B;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKF,QAAQ,CAAC,YAAoB,OAC3B,SAAe,wBAAwB,EAAE,IAAI;AAAA,IAC3C,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,wBAAwB,CACtB,YACA,WACA,SAEA;AAAA,IACE,gCAAgC,SAAS;AAAA,IACzC;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKF,wBAAwB,CAAC,YAAoB,cAC3C;AAAA,IACE,gCAAgC,SAAS;AAAA,IACzC,EAAE,WAAW;AAAA,EACf;AACJ;","names":[]}

package/dist/api/resources.d.ts

@@ -0,0 +1,54 @@
+import type { ResourceItem } from './types';
+export declare const resourcesApi: {
+    /**
+     * List all resources (therapists, rooms, etc.)
+     */
+    list: (tenantSlug: string, type?: string) => Promise<{
+        data: ResourceItem[];
+    }>;
+    /**
+     * Get a single resource by ID
+     */
+    get: (tenantSlug: string, id: string) => Promise<{
+        data: ResourceItem;
+    }>;
+    /**
+     * Create a new resource
+     */
+    create: (tenantSlug: string, data: import("../resource-types").CreateResourceInput) => Promise<import("../resource-types").Resource>;
+    /**
+     * Update a resource
+     */
+    update: (tenantSlug: string, id: string, data: import("../resource-types").UpdateResourceInput) => Promise<import("../resource-types").Resource>;
+    /**
+     * Delete a resource (soft delete)
+     */
+    delete: (tenantSlug: string, id: string) => Promise<void>;
+    /**
+     * Activate a resource
+     */
+    activate: (tenantSlug: string, id: string) => Promise<void>;
+    /**
+     * Deactivate a resource
+     */
+    deactivate: (tenantSlug: string, id: string) => Promise<void>;
+    /**
+     * Reorder resources
+     */
+    reorder: (tenantSlug: string, orderedIds: string[]) => Promise<void>;
+    /**
+     * List resources with full details (typed for dashboard resource management)
+     */
+    listFull: (tenantSlug: string, params?: {
+        type?: string;
+        categoryId?: string;
+        search?: string;
+    }) => Promise<{
+        data: import("../resource-types").Resource[];
+        total: number;
+    }>;
+    /**
+     * Update only the schedule of a resource
+     */
+    updateSchedule: (tenantSlug: string, id: string, schedule: import("../resource-types").WeeklySchedule) => Promise<import("../resource-types").Resource>;
+};

package/dist/api/resources.js

@@ -0,0 +1,92 @@
+import { apiFetch } from "./core";
+const resourcesApi = {
+  /**
+   * List all resources (therapists, rooms, etc.)
+   */
+  list: (tenantSlug, type) => {
+    const query = type ? `?type=${type}` : "";
+    return apiFetch(`/bookings/resources${query}`, {
+      tenantSlug
+    });
+  },
+  /**
+   * Get a single resource by ID
+   */
+  get: (tenantSlug, id) => apiFetch(`/bookings/resources/${id}`, {
+    tenantSlug
+  }),
+  /**
+   * Create a new resource
+   */
+  create: (tenantSlug, data) => apiFetch("/bookings/resources", {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify(data)
+  }),
+  /**
+   * Update a resource
+   */
+  update: (tenantSlug, id, data) => apiFetch(
+    `/bookings/resources/${id}`,
+    {
+      method: "PUT",
+      tenantSlug,
+      body: JSON.stringify(data)
+    }
+  ),
+  /**
+   * Delete a resource (soft delete)
+   */
+  delete: (tenantSlug, id) => apiFetch(`/bookings/resources/${id}`, {
+    method: "DELETE",
+    tenantSlug
+  }),
+  /**
+   * Activate a resource
+   */
+  activate: (tenantSlug, id) => apiFetch(`/bookings/resources/${id}/activate`, {
+    method: "PATCH",
+    tenantSlug
+  }),
+  /**
+   * Deactivate a resource
+   */
+  deactivate: (tenantSlug, id) => apiFetch(`/bookings/resources/${id}/deactivate`, {
+    method: "PATCH",
+    tenantSlug
+  }),
+  /**
+   * Reorder resources
+   */
+  reorder: (tenantSlug, orderedIds) => apiFetch("/bookings/resources/reorder", {
+    method: "POST",
+    tenantSlug,
+    body: JSON.stringify({ orderedIds })
+  }),
+  /**
+   * List resources with full details (typed for dashboard resource management)
+   */
+  listFull: (tenantSlug, params) => {
+    const searchParams = new URLSearchParams();
+    if (params?.type) searchParams.set("type", params.type);
+    if (params?.categoryId) searchParams.set("categoryId", params.categoryId);
+    if (params?.search) searchParams.set("search", params.search);
+    const query = searchParams.toString() ? `?${searchParams.toString()}` : "";
+    return apiFetch(`/bookings/resources${query}`, { tenantSlug });
+  },
+  /**
+   * Update only the schedule of a resource
+   */
+  updateSchedule: (tenantSlug, id, schedule) => apiFetch(
+    `/bookings/resources/${id}`,
+    {
+      method: "PUT",
+      tenantSlug,
+      body: JSON.stringify({ schedule })
+    }
+  )
+};
+export {
+  resourcesApi
+};
+//# sourceMappingURL=resources.js.map

package/dist/api/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/resources.ts"],"sourcesContent":["import { apiFetch } from './core';\nimport type { ResourceItem } from './types';\n\nexport const resourcesApi = {\n  /**\n   * List all resources (therapists, rooms, etc.)\n   */\n  list: (tenantSlug: string, type?: string) => {\n    const query = type ? `?type=${type}` : '';\n    return apiFetch<{ data: ResourceItem[] }>(`/bookings/resources${query}`, {\n      tenantSlug,\n    });\n  },\n\n  /**\n   * Get a single resource by ID\n   */\n  get: (tenantSlug: string, id: string) =>\n    apiFetch<{ data: ResourceItem }>(`/bookings/resources/${id}`, {\n      tenantSlug,\n    }),\n\n  /**\n   * Create a new resource\n   */\n  create: (\n    tenantSlug: string,\n    data: import('../resource-types').CreateResourceInput,\n  ) =>\n    apiFetch<import('../resource-types').Resource>('/bookings/resources', {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify(data),\n    }),\n\n  /**\n   * Update a resource\n   */\n  update: (\n    tenantSlug: string,\n    id: string,\n    data: import('../resource-types').UpdateResourceInput,\n  ) =>\n    apiFetch<import('../resource-types').Resource>(\n      `/bookings/resources/${id}`,\n      {\n        method: 'PUT',\n        tenantSlug,\n        body: JSON.stringify(data),\n      },\n    ),\n\n  /**\n   * Delete a resource (soft delete)\n   */\n  delete: (tenantSlug: string, id: string) =>\n    apiFetch<void>(`/bookings/resources/${id}`, {\n      method: 'DELETE',\n      tenantSlug,\n    }),\n\n  /**\n   * Activate a resource\n   */\n  activate: (tenantSlug: string, id: string) =>\n    apiFetch<void>(`/bookings/resources/${id}/activate`, {\n      method: 'PATCH',\n      tenantSlug,\n    }),\n\n  /**\n   * Deactivate a resource\n   */\n  deactivate: (tenantSlug: string, id: string) =>\n    apiFetch<void>(`/bookings/resources/${id}/deactivate`, {\n      method: 'PATCH',\n      tenantSlug,\n    }),\n\n  /**\n   * Reorder resources\n   */\n  reorder: (tenantSlug: string, orderedIds: string[]) =>\n    apiFetch<void>('/bookings/resources/reorder', {\n      method: 'POST',\n      tenantSlug,\n      body: JSON.stringify({ orderedIds }),\n    }),\n\n  /**\n   * List resources with full details (typed for dashboard resource management)\n   */\n  listFull: (\n    tenantSlug: string,\n    params?: { type?: string; categoryId?: string; search?: string },\n  ) => {\n    const searchParams = new URLSearchParams();\n    if (params?.type) searchParams.set('type', params.type);\n    if (params?.categoryId) searchParams.set('categoryId', params.categoryId);\n    if (params?.search) searchParams.set('search', params.search);\n    const query = searchParams.toString() ? `?${searchParams.toString()}` : '';\n    return apiFetch<{\n      data: import('../resource-types').Resource[];\n      total: number;\n    }>(`/bookings/resources${query}`, { tenantSlug });\n  },\n\n  /**\n   * Update only the schedule of a resource\n   */\n  updateSchedule: (\n    tenantSlug: string,\n    id: string,\n    schedule: import('../resource-types').WeeklySchedule,\n  ) =>\n    apiFetch<import('../resource-types').Resource>(\n      `/bookings/resources/${id}`,\n      {\n        method: 'PUT',\n        tenantSlug,\n        body: JSON.stringify({ schedule }),\n      },\n    ),\n};\n\n// ============================================\n// RESOURCE CATEGORIES API\n// ============================================\n"],"mappings":"AAAA,SAAS,gBAAgB;AAGlB,MAAM,eAAe;AAAA;AAAA;AAAA;AAAA,EAI1B,MAAM,CAAC,YAAoB,SAAkB;AAC3C,UAAM,QAAQ,OAAO,SAAS,IAAI,KAAK;AACvC,WAAO,SAAmC,sBAAsB,KAAK,IAAI;AAAA,MACvE;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK,CAAC,YAAoB,OACxB,SAAiC,uBAAuB,EAAE,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,QAAQ,CACN,YACA,SAEA,SAA+C,uBAAuB;AAAA,IACpE,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,QAAQ,CACN,YACA,IACA,SAEA;AAAA,IACE,uBAAuB,EAAE;AAAA,IACzB;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKF,QAAQ,CAAC,YAAoB,OAC3B,SAAe,uBAAuB,EAAE,IAAI;AAAA,IAC1C,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,UAAU,CAAC,YAAoB,OAC7B,SAAe,uBAAuB,EAAE,aAAa;AAAA,IACnD,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,YAAY,CAAC,YAAoB,OAC/B,SAAe,uBAAuB,EAAE,eAAe;AAAA,IACrD,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,SAAS,CAAC,YAAoB,eAC5B,SAAe,+BAA+B;AAAA,IAC5C,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,EAAE,WAAW,CAAC;AAAA,EACrC,CAAC;AAAA;AAAA;AAAA;AAAA,EAKH,UAAU,CACR,YACA,WACG;AACH,UAAM,eAAe,IAAI,gBAAgB;AACzC,QAAI,QAAQ,KAAM,cAAa,IAAI,QAAQ,OAAO,IAAI;AACtD,QAAI,QAAQ,WAAY,cAAa,IAAI,cAAc,OAAO,UAAU;AACxE,QAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,UAAM,QAAQ,aAAa,SAAS,IAAI,IAAI,aAAa,SAAS,CAAC,KAAK;AACxE,WAAO,SAGJ,sBAAsB,KAAK,IAAI,EAAE,WAAW,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,CACd,YACA,IACA,aAEA;AAAA,IACE,uBAAuB,EAAE;AAAA,IACzB;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,IACnC;AAAA,EACF;AACJ;","names":[]}

package/dist/api/reviews.d.ts

@@ -0,0 +1,18 @@
+import type { ReviewStatus, ReviewItem, ReviewsListResponse, ReviewsQuery, ReviewStats } from './types';
+export declare const reviewsApi: {
+    /** List all reviews (admin) */
+    list: (tenantSlug: string, query?: ReviewsQuery) => Promise<ReviewsListResponse>;
+    /** Rating summary for a single content item (product) */
+    getStats: (tenantSlug: string, contentId: string) => Promise<ReviewStats>;
+    /** Get a single review */
+    get: (tenantSlug: string, reviewId: string) => Promise<ReviewItem>;
+    /** Moderate a review (approve, reject, flag) */
+    moderate: (tenantSlug: string, reviewId: string, data: {
+        status: ReviewStatus;
+        note?: string;
+    }) => Promise<ReviewItem>;
+    /** Add merchant response to a review */
+    respond: (tenantSlug: string, reviewId: string, response: string) => Promise<ReviewItem>;
+    /** Delete a review */
+    delete: (tenantSlug: string, reviewId: string) => Promise<void>;
+};