@withpotter/lib 0.13.0-next.101

package/dist/api/types/auth.d.ts

@@ -0,0 +1,206 @@
+import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/browser';
+/**
+ * AUTH / ACCOUNTS API — as the API sends it.
+ *
+ * One slice of what was a 4,164-line `types.ts`. The sections were already
+ * here as comment fences; they are files now, so a type is found by the
+ * endpoint it belongs to rather than by scrolling.
+ */
+/**
+ * Every request/response shape the API layer uses.
+ *
+ * Kept in one module on purpose: interfaces and types are erased at build
+ * time, so grouping them costs nothing at runtime while keeping the domain
+ * modules free of cross-imports for shared shapes.
+ */
+export interface FetchOptions extends RequestInit {
+    tenantSlug?: string;
+    token?: string;
+    accountId?: string;
+}
+export interface SignupInput {
+    email: string;
+    name: string;
+    password?: string;
+}
+export interface SignupResult {
+    account: {
+        id: string;
+        email: string;
+        name: string;
+        avatarUrl?: string;
+        /** Optional; null or absent when the account has none. */
+        phone?: string | null;
+        authProvider: string;
+        status: string;
+        mfaEnabled?: boolean;
+    };
+    organizationId: string;
+    token?: string;
+}
+export interface UpdateAccountInput {
+    name?: string;
+    avatarUrl?: string;
+    /** Optional. An empty string clears it. */
+    phone?: string;
+}
+export interface ChangePasswordInput {
+    currentPassword: string;
+    newPassword: string;
+}
+export interface ChangeEmailInput {
+    newEmail: string;
+    password: string;
+}
+export interface LoginTenantInfo {
+    id: string;
+    name: string;
+    slug: string;
+    templateId: string;
+    role: string;
+    permissions?: Record<string, boolean>;
+    organizationId: string | null;
+    businessLogo: string | null;
+    contactEmail: string | null;
+    contactPhone: string | null;
+    customDomain: string | null;
+    status: string;
+    settings: Record<string, unknown> | null;
+}
+/** Account payload from authenticated endpoints. */
+export interface AuthAccount {
+    id: string;
+    email: string;
+    name: string;
+    avatarUrl?: string | null;
+    phone?: string | null;
+    authProvider: string;
+    status: string;
+    emailVerified?: boolean;
+    mfaEnabled?: boolean;
+    organizationId?: string | null;
+}
+/** Successful session payload (Google sign-in `signed-in`/`created`, and login). */
+export interface AuthSessionPayload {
+    account: AuthAccount;
+    /** Only a native client gets one; the browser session is a cookie. Never stored. */
+    token?: string;
+    tenants: LoginTenantInfo[];
+    organizationId: string | null;
+    sessionId?: string;
+}
+/** Returned when a Google email matches an existing password-only account. */
+export interface GoogleSignInCollisionPayload {
+    email: string;
+    accountId: string;
+    googleSub: string;
+    name: string | null;
+    avatarUrl: string | null;
+}
+/** /accounts/google/callback response. `kind` discriminates the next step. */
+export interface GoogleSignInCallbackResult extends Partial<AuthSessionPayload> {
+    kind: 'signed-in' | 'created' | 'collision';
+    collision?: GoogleSignInCollisionPayload;
+}
+export interface GoogleLinkInput {
+    accountId: string;
+    password: string;
+    googleSub: string;
+}
+/** Per-account communication + analytics consent. */
+export interface AccountConsent {
+    productEmails: boolean;
+    productSms: boolean;
+    analytics: boolean;
+    /** ISO timestamp of the last change, when the account has ever set it. */
+    updatedAt?: string;
+}
+export type ConsentInput = Pick<AccountConsent, 'productEmails' | 'productSms' | 'analytics'>;
+export interface MfaSetupResult {
+    /** Base32 secret, for manual entry when a QR can't be scanned. */
+    secret: string;
+    /** otpauth:// URI encoded in the QR. */
+    otpauthUrl: string;
+    /** Ready-to-render data: URL of the QR image. */
+    qrDataUri: string;
+}
+export interface MfaVerifyResult {
+    enabled: true;
+    /** One-time backup codes — display once, never retrievable again. */
+    backupCodes: string[];
+}
+export interface SendLoginCodeResult {
+    message: string;
+}
+/** One enrolled authenticator, as the settings list sees it. */
+export interface Passkey {
+    id: string;
+    /** What the owner named it. Null until they do. */
+    name: string | null;
+    /** `singleDevice` keys die with the hardware; `multiDevice` ones sync. */
+    deviceType: string | null;
+    backedUp: boolean;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+export interface BeginPasskeyLoginResult {
+    /** Ties the response back to the challenge the server issued. */
+    handle: string;
+    options: PublicKeyCredentialRequestOptionsJSON;
+}
+export interface PasskeyLoginResult extends AuthSessionPayload {
+    /**
+     * Whether the authenticator verified the person, not just held the key.
+     *
+     * True means the gesture already carried both factors, so an MFA-enabled
+     * account must NOT then be asked for a TOTP code — that would make the safer
+     * route the more annoying one.
+     */
+    mfaSatisfied: boolean;
+}
+export interface VerifyLoginCodeSession extends AuthSessionPayload {
+    /** True when this verify created the account (route to onboarding). */
+    isNewAccount: boolean;
+}
+/**
+ * What a door returns when the first factor passed but the account owes a
+ * second.
+ *
+ * No token and no account: nothing here authenticates anything. The `mfaToken`
+ * is single-use, short-lived and attempt-capped, and is accepted only by
+ * /accounts/mfa/challenge.
+ */
+export interface MfaChallengeRequired {
+    mfaRequired: true;
+    mfaToken: string;
+}
+/**
+ * A union rather than an optional field, so a caller cannot read `.token` off a
+ * challenge by accident. It caught a real mismatch on the API side.
+ */
+export type VerifyLoginCodeResult = VerifyLoginCodeSession | MfaChallengeRequired;
+export declare function isMfaChallenge(result: AuthSessionPayload | MfaChallengeRequired): result is MfaChallengeRequired;
+export type DeviceKind = 'mobile' | 'tablet' | 'desktop' | 'web';
+export interface ConnectedDeviceRecord {
+    id: string;
+    name: string;
+    kind: DeviceKind;
+    location?: string;
+    lastSeen: string;
+    isCurrent?: boolean;
+}
+export interface ProvisionTenantInput {
+    organizationId: string;
+    /** Omit it — the API derives the starting look from `intents`. Send one only
+     *  when the merchant deliberately chose a template. */
+    templateId?: string;
+    businessName: string;
+    slug?: string;
+    email?: string;
+    phone?: string;
+    category?: string;
+    /** ISO 4217 default currency, derived from country. */
+    currency?: string;
+    intents?: string[];
+    isSolo?: boolean;
+}

package/dist/api/types/auth.js

@@ -0,0 +1,7 @@
+function isMfaChallenge(result) {
+  return result.mfaRequired === true;
+}
+export {
+  isMfaChallenge
+};
+//# sourceMappingURL=auth.js.map

package/dist/api/types/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/api/types/auth.ts"],"sourcesContent":["import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/browser';\n\n/**\n * AUTH / ACCOUNTS API — as the API sends it.\n *\n * One slice of what was a 4,164-line `types.ts`. The sections were already\n * here as comment fences; they are files now, so a type is found by the\n * endpoint it belongs to rather than by scrolling.\n */\n\n/**\n * Every request/response shape the API layer uses.\n *\n * Kept in one module on purpose: interfaces and types are erased at build\n * time, so grouping them costs nothing at runtime while keeping the domain\n * modules free of cross-imports for shared shapes.\n */\nexport interface FetchOptions extends RequestInit {\n  tenantSlug?: string;\n  token?: string;\n  accountId?: string;\n}\n\nexport interface SignupInput {\n  email: string;\n  name: string;\n  password?: string;\n}\n\nexport interface SignupResult {\n  account: {\n    id: string;\n    email: string;\n    name: string;\n    avatarUrl?: string;\n    /** Optional; null or absent when the account has none. */\n    phone?: string | null;\n    authProvider: string;\n    status: string;\n    mfaEnabled?: boolean;\n  };\n  organizationId: string;\n  token?: string;\n}\n\nexport interface UpdateAccountInput {\n  name?: string;\n  avatarUrl?: string;\n  /** Optional. An empty string clears it. */\n  phone?: string;\n}\n\nexport interface ChangePasswordInput {\n  currentPassword: string;\n  newPassword: string;\n}\n\nexport interface ChangeEmailInput {\n  newEmail: string;\n  password: string;\n}\n\nexport interface LoginTenantInfo {\n  id: string;\n  name: string;\n  slug: string;\n  templateId: string;\n  role: string;\n  permissions?: Record<string, boolean>;\n  organizationId: string | null;\n  businessLogo: string | null;\n  contactEmail: string | null;\n  contactPhone: string | null;\n  customDomain: string | null;\n  status: string;\n  settings: Record<string, unknown> | null;\n}\n\n/** Account payload from authenticated endpoints. */\nexport interface AuthAccount {\n  id: string;\n  email: string;\n  name: string;\n  avatarUrl?: string | null;\n  phone?: string | null;\n  authProvider: string;\n  status: string;\n  emailVerified?: boolean;\n  mfaEnabled?: boolean;\n  organizationId?: string | null;\n}\n\n/** Successful session payload (Google sign-in `signed-in`/`created`, and login). */\nexport interface AuthSessionPayload {\n  account: AuthAccount;\n  /** Only a native client gets one; the browser session is a cookie. Never stored. */\n  token?: string;\n  tenants: LoginTenantInfo[];\n  organizationId: string | null;\n  sessionId?: string;\n}\n\n/** Returned when a Google email matches an existing password-only account. */\nexport interface GoogleSignInCollisionPayload {\n  email: string;\n  accountId: string;\n  googleSub: string;\n  name: string | null;\n  avatarUrl: string | null;\n}\n\n/** /accounts/google/callback response. `kind` discriminates the next step. */\nexport interface GoogleSignInCallbackResult extends Partial<AuthSessionPayload> {\n  kind: 'signed-in' | 'created' | 'collision';\n  collision?: GoogleSignInCollisionPayload;\n}\n\nexport interface GoogleLinkInput {\n  accountId: string;\n  password: string;\n  googleSub: string;\n}\n\n/** Per-account communication + analytics consent. */\nexport interface AccountConsent {\n  productEmails: boolean;\n  productSms: boolean;\n  analytics: boolean;\n  /** ISO timestamp of the last change, when the account has ever set it. */\n  updatedAt?: string;\n}\n\nexport type ConsentInput = Pick<\n  AccountConsent,\n  'productEmails' | 'productSms' | 'analytics'\n>;\n\nexport interface MfaSetupResult {\n  /** Base32 secret, for manual entry when a QR can't be scanned. */\n  secret: string;\n  /** otpauth:// URI encoded in the QR. */\n  otpauthUrl: string;\n  /** Ready-to-render data: URL of the QR image. */\n  qrDataUri: string;\n}\n\nexport interface MfaVerifyResult {\n  enabled: true;\n  /** One-time backup codes — display once, never retrievable again. */\n  backupCodes: string[];\n}\n\nexport interface SendLoginCodeResult {\n  message: string;\n}\n\n/** One enrolled authenticator, as the settings list sees it. */\nexport interface Passkey {\n  id: string;\n  /** What the owner named it. Null until they do. */\n  name: string | null;\n  /** `singleDevice` keys die with the hardware; `multiDevice` ones sync. */\n  deviceType: string | null;\n  backedUp: boolean;\n  createdAt: string;\n  lastUsedAt: string | null;\n}\n\nexport interface BeginPasskeyLoginResult {\n  /** Ties the response back to the challenge the server issued. */\n  handle: string;\n  options: PublicKeyCredentialRequestOptionsJSON;\n}\n\nexport interface PasskeyLoginResult extends AuthSessionPayload {\n  /**\n   * Whether the authenticator verified the person, not just held the key.\n   *\n   * True means the gesture already carried both factors, so an MFA-enabled\n   * account must NOT then be asked for a TOTP code — that would make the safer\n   * route the more annoying one.\n   */\n  mfaSatisfied: boolean;\n}\n\nexport interface VerifyLoginCodeSession extends AuthSessionPayload {\n  /** True when this verify created the account (route to onboarding). */\n  isNewAccount: boolean;\n}\n\n/**\n * What a door returns when the first factor passed but the account owes a\n * second.\n *\n * No token and no account: nothing here authenticates anything. The `mfaToken`\n * is single-use, short-lived and attempt-capped, and is accepted only by\n * /accounts/mfa/challenge.\n */\nexport interface MfaChallengeRequired {\n  mfaRequired: true;\n  mfaToken: string;\n}\n\n/**\n * A union rather than an optional field, so a caller cannot read `.token` off a\n * challenge by accident. It caught a real mismatch on the API side.\n */\nexport type VerifyLoginCodeResult =\n  | VerifyLoginCodeSession\n  | MfaChallengeRequired;\n\nexport function isMfaChallenge(\n  result: AuthSessionPayload | MfaChallengeRequired,\n): result is MfaChallengeRequired {\n  return (result as MfaChallengeRequired).mfaRequired === true;\n}\n\nexport type DeviceKind = 'mobile' | 'tablet' | 'desktop' | 'web';\n\nexport interface ConnectedDeviceRecord {\n  id: string;\n  name: string;\n  kind: DeviceKind;\n  location?: string;\n  lastSeen: string;\n  isCurrent?: boolean;\n}\n\nexport interface ProvisionTenantInput {\n  organizationId: string;\n  /** Omit it — the API derives the starting look from `intents`. Send one only\n   *  when the merchant deliberately chose a template. */\n  templateId?: string;\n  businessName: string;\n  slug?: string;\n  email?: string;\n  phone?: string;\n  category?: string;\n  /** ISO 4217 default currency, derived from country. */\n  currency?: string;\n  intents?: string[];\n  isSolo?: boolean;\n}\n"],"mappings":"AAmNO,SAAS,eACd,QACgC;AAChC,SAAQ,OAAgC,gBAAgB;AAC1D;","names":[]}

package/dist/api/types/automation-flow.d.ts

@@ -0,0 +1,199 @@
+/**
+ * AUTOMATION FLOWS — as the API sends and takes them.
+ *
+ * An automation's flow is a TREE of steps: a condition or a split holds its own
+ * lists of steps, and when the chosen list ends the journey carries on after
+ * the condition. See potter-api `modules/automations/flow/flow.types.ts`, which
+ * these mirror.
+ */
+export type ConditionOperator = 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with' | 'is_set' | 'is_not_set' | 'any_of' | 'none_of' | 'all_of';
+export interface ConditionRule {
+    field: string;
+    operator: ConditionOperator;
+    value?: string | number | boolean | string[];
+}
+export interface ConditionGroup {
+    match: 'all' | 'any';
+    rules: Array<ConditionRule | ConditionGroup>;
+}
+export type FlowStepType = 'send_email' | 'send_sms' | 'send_push' | 'add_tag' | 'remove_tag' | 'update_note' | 'add_to_segment' | 'notify_team' | 'http_request' | 'create_discount' | 'wait' | 'wait_until' | 'condition' | 'split' | 'end';
+export interface ConditionBranch {
+    id: string;
+    label?: string;
+    when: ConditionGroup;
+    steps: FlowStep[];
+}
+export interface SplitArm {
+    id: string;
+    label?: string;
+    weight: number;
+    holdout?: boolean;
+    steps: FlowStep[];
+}
+/**
+ * One step. A single interface with every field optional rather than a union:
+ * the builder edits whichever fields the chosen type uses, and the API checks
+ * the rest, so a union would only be narrowed and re-widened in every form.
+ */
+export interface FlowStep {
+    id: string;
+    type: FlowStepType;
+    subject?: string;
+    body?: string;
+    fallbackToEmail?: boolean;
+    fallbackSubject?: string;
+    tag?: string;
+    note?: string;
+    mode?: 'append' | 'replace';
+    segmentId?: string;
+    title?: string;
+    message?: string;
+    url?: string;
+    method?: 'POST' | 'PUT' | 'PATCH' | 'GET';
+    headers?: Record<string, string>;
+    kind?: 'percentage' | 'fixed';
+    value?: number;
+    expiresInDays?: number;
+    prefix?: string;
+    minutes?: number;
+    time?: string;
+    weekdays?: number[];
+    branches?: ConditionBranch[];
+    else?: FlowStep[];
+    arms?: SplitArm[];
+}
+export interface ScheduleSpec {
+    every: 'quarter_hour' | 'hour' | 'day' | 'week' | 'month';
+    at?: string;
+    weekday?: number;
+    dayOfMonth?: number;
+}
+export interface AutomationSettings {
+    reentry?: {
+        mode: 'once' | 'always' | 'after_days';
+        days?: number;
+    };
+    exitWhen?: {
+        purchased?: boolean;
+        conditions?: ConditionGroup;
+    };
+    recheckConditions?: boolean;
+    schedule?: ScheduleSpec;
+    audience?: {
+        kind: 'everyone' | 'segment' | 'none';
+        segmentId?: string;
+    };
+    conversionWindowDays?: number;
+}
+export interface FieldDef {
+    key: string;
+    label: string;
+    kind: 'number' | 'text' | 'boolean' | 'list';
+    group: 'Customer' | 'This event';
+    hint?: string;
+}
+export interface TriggerInfo {
+    id: string;
+    label: string;
+    description: string;
+    group: string;
+    /** False for triggers about a product rather than a person. */
+    hasPerson: boolean;
+    fields: FieldDef[];
+}
+export interface StepInfo {
+    id: FlowStepType;
+    label: string;
+    group: string;
+    description: string;
+}
+export interface BuilderCatalog {
+    triggers: TriggerInfo[];
+    steps: StepInfo[];
+    operators: Record<FieldDef['kind'], ConditionOperator[]>;
+    limits: Record<string, number>;
+    liveTriggers: string[];
+    /** Whether messages can really leave this server, per channel. */
+    delivery?: {
+        email: boolean;
+        sms: boolean;
+    };
+}
+export interface AutomationTemplate {
+    id: string;
+    name: string;
+    description: string;
+    group: string;
+    /** The product it sends to, when it really does (a webhook): draw its logo. */
+    brand?: string;
+    trigger: string;
+    steps: FlowStep[];
+    conditions?: ConditionGroup;
+    settings?: AutomationSettings;
+}
+export interface FlowIssues {
+    errors: string[];
+    warnings: string[];
+}
+export interface AutomationResults {
+    windowDays: number;
+    journeys: {
+        entered: number;
+        active: number;
+        completed: number;
+        exited: number;
+        failed: number;
+        exitReasons: Record<string, number>;
+    };
+    arms: Array<{
+        arm: string;
+        entered: number;
+        converted: number;
+        revenueByCurrency: Record<string, number>;
+        rate: number;
+    }>;
+    hasHoldout: boolean;
+}
+export interface TestPathStep {
+    stepId: string;
+    type: FlowStepType;
+    result: 'run' | 'skip' | 'wait' | 'chose' | 'stop';
+    detail: string;
+    waitMinutes?: number | null;
+    /** For a condition or split: the branch or path taken; `else` for otherwise. */
+    chosenId?: string | null;
+}
+export interface TestResult {
+    entry: {
+        enters: boolean;
+        reason: string | null;
+    };
+    path: TestPathStep[];
+}
+export interface StepStat {
+    done: number;
+    skipped: number;
+    failed: number;
+    pending: number;
+    skippedByReason: Record<string, number>;
+}
+/** One saved version of an automation's flow. */
+export interface AutomationVersionEntry {
+    version: number;
+    name: string;
+    trigger: string;
+    steps: FlowStep[];
+    conditions: ConditionGroup | null;
+    settings: AutomationSettings;
+    savedAt: string;
+}
+/** A message filled in for one customer, as it would be sent. */
+export interface MessagePreview {
+    channel: 'email' | 'sms';
+    subject: string | null;
+    /** HTML for an email, plain text for a text. */
+    body: string;
+    filledFor: string;
+    /** Placeholders that had nothing to fill them. */
+    empty: string[];
+}

package/dist/api/types/automation-flow.js

@@ -0,0 +1 @@
+//# sourceMappingURL=automation-flow.js.map

package/dist/api/types/automation-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/api/types/bookings.d.ts

@@ -0,0 +1,226 @@
+import type { WeeklySchedule } from '@withpotter/lib/resource-types';
+/**
+ * BOOKINGS API (special endpoint, not under /content) — as the API sends it.
+ *
+ * One slice of what was a 4,164-line `types.ts`. The sections were already
+ * here as comment fences; they are files now, so a type is found by the
+ * endpoint it belongs to rather than by scrolling.
+ */
+export type BookingMode = 'scheduled' | 'check_in' | 'pickup_dropoff' | 'reservation' | 'walk_in_staff_created';
+export type BookingActorType = 'customer' | 'staff';
+export type BookingOrigin = 'storefront' | 'dashboard' | 'api';
+export interface BookingItem {
+    id: string;
+    tenantId: string;
+    type: string;
+    status: string;
+    bookingNumber: string;
+    date: string;
+    /**
+     * The date a booking ends, when that is a different day.
+     *
+     * Without it a four-night stay is indistinguishable from an eight-hour
+     * appointment, because only the clock times survive. Absent for same-day
+     * bookings.
+     */
+    endDate?: string | null;
+    startTime?: string;
+    endTime?: string;
+    durationMinutes?: number;
+    quantity?: number;
+    ticketCode?: string | null;
+    checkedInAt?: string | null;
+    /**
+     * Who let them in, and on what.
+     *
+     * The morning-after question a roster could not answer: `checkedInAt` alone
+     * says a ticket was used, not who was on the door or which machine they were
+     * holding. `checkedInVia` is a device id — the till may be retired or
+     * re-enrolled before anybody reads this back, so it is a string rather than
+     * a reference. Null on every check-in taken before the audit existed, and on
+     * a desk check-in with nobody signed in, which is a real answer rather than
+     * a gap.
+     */
+    checkedInBy?: string | null;
+    checkedInVia?: string | null;
+    checkedInSource?: 'device' | 'dashboard' | null;
+    customerEmail?: string;
+    customerName?: string;
+    customerPhone?: string;
+    customerNote?: string;
+    memberId?: string | null;
+    orderId?: string | null;
+    data?: Record<string, unknown> | null;
+    metadata?: Record<string, unknown>;
+    resourceId?: string;
+    /** "Court 1", "Studio B" — the thing that was actually booked. */
+    resourceName?: string | null;
+    contentId?: string;
+    content?: {
+        id: string;
+        title: string;
+        slug: string;
+        price?: number;
+    } | null;
+    bookingMode?: BookingMode;
+    schedulePayload?: Record<string, unknown>;
+    actorType?: BookingActorType;
+    origin?: BookingOrigin;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface BookingListResponse {
+    data: BookingItem[];
+    total: number;
+    page: number;
+    limit: number;
+}
+export interface TicketItem {
+    id: string;
+    tenantId: string;
+    bookingId: string;
+    ticketCode: string | null;
+    tierId: string | null;
+    seatLabel: string | null;
+    attendeeName: string | null;
+    attendeeEmail: string | null;
+    checkedInAt: string | null;
+    status: 'active' | 'cancelled' | 'transferred';
+    data: Record<string, unknown>;
+    createdAt: string;
+    updatedAt: string;
+}
+export type TicketScanCode = 'checked_in' | 'duplicate_scan' | 'invalid_ticket_code' | 'unpaid_ticket' | 'ticket_not_active' | 'scan_failed';
+export interface TicketScanResponse {
+    booking: BookingItem;
+    checkedIn: boolean;
+    message: string;
+    code?: TicketScanCode;
+    requestId?: string | null;
+    ticketId?: string;
+    ticketLabel?: string;
+}
+export interface CreateBookingInput {
+    type: 'appointment' | 'class' | 'table' | 'room' | 'event' | 'resource';
+    date: string;
+    /** Optional: walk-ins/phone bookings are keyed on name + phone, not email. */
+    customerEmail?: string;
+    contentId?: string;
+    resourceId?: string;
+    memberId?: string;
+    startTime?: string;
+    endTime?: string;
+    durationMinutes?: number;
+    timezone?: string;
+    quantity?: number;
+    customerName?: string;
+    customerPhone?: string;
+    total?: number;
+    customerNote?: string;
+    sendReminders?: boolean;
+    metadata?: Record<string, unknown>;
+    autoConfirm?: boolean;
+    bookingMode?: BookingMode;
+    schedulePayload?: Record<string, unknown>;
+    actorType?: BookingActorType;
+    origin?: BookingOrigin;
+    overrideCapacity?: boolean;
+}
+/** A single money movement on a booking (payment or refund). Amounts in main units. */
+export interface BookingFinanceEntry {
+    id: string;
+    type: 'payment' | 'refund';
+    status: string;
+    amount: number;
+    refundedAmount: number;
+    currency: string;
+    channel: string | null;
+    reference: string;
+    description: string | null;
+    createdAt: string;
+}
+/**
+ * Where a refundable security deposit stands.
+ *
+ * `due` charged with the booking but not yet collected, `held` collected and
+ * sitting with the owner, `released` given back, `forfeited` kept against
+ * damage.
+ */
+export type DepositStatus = 'due' | 'held' | 'released' | 'forfeited';
+/** The authoritative money picture for a booking (from its transactions). */
+export interface BookingFinance {
+    total: number;
+    paid: number;
+    refunded: number;
+    balance: number;
+    currency: string;
+    entries: BookingFinanceEntry[];
+    /** The refundable deposit inside `total`. Null when there isn't one. */
+    securityDeposit: number | null;
+    depositStatus: DepositStatus | null;
+    /** What the booking earned, with the deposit taken back out. */
+    revenue: number;
+}
+/** One payer in a group/split booking. */
+export interface SplitParticipant {
+    id: string;
+    bookingId: string;
+    name: string;
+    email?: string | null;
+    phone?: string | null;
+    shareAmount: number;
+    currency: string;
+    status: 'pending' | 'paid' | 'cancelled';
+    paidAt?: string | null;
+}
+export interface SplitSummary {
+    activeCount: number;
+    paidCount: number;
+    paidTotal: number;
+    pledgedTotal: number;
+    outstanding: number;
+    isSettled: boolean;
+}
+/** Who's in a split booking, who's paid, what's outstanding. */
+export interface SplitBooking {
+    participants: SplitParticipant[];
+    summary: SplitSummary;
+}
+/** One generated slot. Mirrors AvailableSlotDto in potter-api. */
+export interface AvailableSlot {
+    date: string;
+    startTime: string;
+    endTime: string;
+    durationMinutes: number;
+    available: boolean;
+    remainingSpots: number;
+    price?: number;
+}
+/** Mirrors AvailabilityResponseDto in potter-api. */
+export interface AvailabilityResponse {
+    resourceId: string;
+    resourceName: string;
+    dateFrom: string;
+    dateTo: string;
+    slots: AvailableSlot[];
+}
+export interface ResourceItem {
+    id: string;
+    tenantId: string;
+    type: string;
+    name: string;
+    description?: string;
+    status: 'active' | 'inactive';
+    timezone?: string | null;
+    defaultDurationMinutes?: number;
+    photo?: {
+        url: string;
+    } | null;
+    metadata?: Record<string, unknown>;
+    /**
+     * The week this resource works. `/bookings/resources` has always returned
+     * it — the field was simply absent here, so a caller reading availability
+     * off the list had to widen the type by hand.
+     */
+    schedule?: WeeklySchedule | null;
+}

package/dist/api/types/bookings.js

@@ -0,0 +1 @@
+//# sourceMappingURL=bookings.js.map

package/dist/api/types/bookings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}