spaps-sdk 1.2.0 → 1.3.0

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, Price, Product, ProductSyncResult, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, createSecureMessageRequestSchema, secureMessageMetadataSchema, secureMessageSchema } from 'spaps-types';
+import { CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, Price, Product, ProductSyncResult, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, createSecureMessageRequestSchema, secureMessageMetadataSchema, secureMessageSchema } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -244,14 +244,13 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
             password: string;
         }) => Promise<any>;
         /**
-         * Verify a magic link token. Does not set access/refresh tokens.
-         * Consumers should redirect or prompt login based on the returned status.
+         * Verify a magic link token and authenticate the user.
+         * Returns full auth response with tokens and auto-stores them.
          */
         verifyMagicLink: (payload: {
             token: string;
-        }) => Promise<{
-            success: boolean;
-        }>;
+            type?: string;
+        }) => Promise<AuthResponse>;
         solana: {
             linkWallet: (payload: {
                 wallet_address: string;
@@ -402,6 +401,72 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
         revokeAll: () => Promise<any>;
         touch: () => Promise<any>;
     };
+    /**
+     * CFO (QuickBooks) namespace for managing multi-account connections
+     */
+    cfo: {
+        /**
+         * Get all QuickBooks connections for the current user
+         */
+        getConnections: () => Promise<{
+            connections: Array<{
+                id: string;
+                status: string;
+                companyName?: string;
+                realmId?: string;
+                connectedAt?: string;
+            }>;
+        }>;
+        /**
+         * Get connection status (returns primary connection for backward compatibility)
+         */
+        getStatus: () => Promise<{
+            connection: {
+                id: string;
+                status: string;
+                companyName?: string;
+                realmId?: string;
+            } | null;
+            totalConnections: number;
+        }>;
+        /**
+         * Start adding a new QuickBooks connection
+         * Returns auth URL to redirect user to QuickBooks OAuth
+         */
+        addConnection: () => Promise<{
+            authUrl: string;
+            connectionId: string;
+            existingConnections: number;
+        }>;
+        /**
+         * Disconnect a specific QuickBooks account
+         */
+        disconnect: (connectionId: string) => Promise<{
+            success: boolean;
+            message: string;
+        }>;
+    };
+    /**
+     * DayRate (Dynamic Scheduling) namespace
+     * For booking half-day sessions with dynamic pricing
+     */
+    dayrate: {
+        /**
+         * Get available slots with current pricing
+         * Public endpoint - no authentication required
+         */
+        getAvailability: () => Promise<DayrateAvailabilityResponse>;
+        /**
+         * Create a single-slot booking and get Stripe checkout URL
+         * Returns a 10-minute reservation with checkout link
+         */
+        createBooking: (payload: DayrateBookingRequest) => Promise<DayrateBookingResponse>;
+        /**
+         * Create a multi-slot booking and get Stripe checkout URL
+         * Reserves multiple slots with a single checkout session
+         */
+        createMultiBooking: (payload: DayrateMultiBookingRequest) => Promise<DayrateMultiBookingResponse>;
+    };
     createCheckoutSession(priceId: string, successUrl: string, cancelUrl?: string): Promise<{
         data: CheckoutSession;
     }>;
@@ -462,6 +527,12 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
     isAuthenticated(): boolean;
     getAccessToken(): string | undefined;
     setAccessToken(token: string): void;
+    setRefreshToken(token: string): void;
+    /**
+     * Restore tokens (for SSO/OAuth flows)
+     * Sets both access and refresh tokens
+     */
+    restoreTokens(accessToken: string, refreshToken?: string): void;
     isLocalMode(): boolean;
     /**
      * Check if current user has admin privileges
@@ -478,6 +549,10 @@ declare class TokenManager {
     private static readonly ACCESS_TOKEN_KEY;
     private static readonly REFRESH_TOKEN_KEY;
     private static readonly USER_KEY;
+    /**
+     * Cross-platform base64 decode (works in both Node.js and browser)
+     */
+    private static base64Decode;
     private static getStorage;
     static storeTokens(tokens: AuthResponse): void;
     static getAccessToken(): string | null;
@@ -486,6 +561,24 @@ declare class TokenManager {
     static clearTokens(): void;
     static isTokenExpired(token: string): boolean;
     static autoRefreshToken(sdk: SPAPSClient): Promise<boolean>;
+    /**
+     * Parse auth tokens from URL fragment (for OAuth callbacks)
+     * URL format: https://app.com/callback#access_token=xxx&refresh_token=xxx
+     */
+    static parseTokensFromUrlFragment(url?: string): {
+        access_token?: string;
+        refresh_token?: string;
+        user_id?: string;
+    } | null;
+    /**
+     * Handle OAuth callback - parse tokens from URL and store them
+     * Returns user info decoded from JWT, or null if no tokens found
+     */
+    static handleOAuthCallback(sdk: SPAPSClient): {
+        id: string;
+        email?: string;
+        role?: string;
+    } | null;
 }
 declare class WalletUtils {
     static detectChainType(address: string): 'solana' | 'ethereum' | 'bitcoin' | null;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as spaps_types from 'spaps-types';
-import { CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, Price, Product, ProductSyncResult, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, createSecureMessageRequestSchema, secureMessageMetadataSchema, secureMessageSchema } from 'spaps-types';
+import { CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, CreateSecureMessageRequest, SecureMessage, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, DayrateAvailabilityResponse, DayrateBookingRequest, DayrateBookingResponse, DayrateMultiBookingRequest, DayrateMultiBookingResponse, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreatePriceRequest, CreateProductRequest, CreateSecureMessageInput, CreateSecureMessageRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, DayrateAvailabilityResponse, DayrateAvailableSlot, DayrateBookingRequest, DayrateBookingResponse, DayrateDayOfWeek, DayrateMultiBookingRequest, DayrateMultiBookingResponse, DayratePriceBreakdown, DayrateSlotType, Price, Product, ProductSyncResult, SecureMessage, SecureMessageOutput, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions, createSecureMessageRequestSchema, secureMessageMetadataSchema, secureMessageSchema } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -244,14 +244,13 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
             password: string;
         }) => Promise<any>;
         /**
-         * Verify a magic link token. Does not set access/refresh tokens.
-         * Consumers should redirect or prompt login based on the returned status.
+         * Verify a magic link token and authenticate the user.
+         * Returns full auth response with tokens and auto-stores them.
          */
         verifyMagicLink: (payload: {
             token: string;
-        }) => Promise<{
-            success: boolean;
-        }>;
+            type?: string;
+        }) => Promise<AuthResponse>;
         solana: {
             linkWallet: (payload: {
                 wallet_address: string;
@@ -402,6 +401,72 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
         revokeAll: () => Promise<any>;
         touch: () => Promise<any>;
     };
+    /**
+     * CFO (QuickBooks) namespace for managing multi-account connections
+     */
+    cfo: {
+        /**
+         * Get all QuickBooks connections for the current user
+         */
+        getConnections: () => Promise<{
+            connections: Array<{
+                id: string;
+                status: string;
+                companyName?: string;
+                realmId?: string;
+                connectedAt?: string;
+            }>;
+        }>;
+        /**
+         * Get connection status (returns primary connection for backward compatibility)
+         */
+        getStatus: () => Promise<{
+            connection: {
+                id: string;
+                status: string;
+                companyName?: string;
+                realmId?: string;
+            } | null;
+            totalConnections: number;
+        }>;
+        /**
+         * Start adding a new QuickBooks connection
+         * Returns auth URL to redirect user to QuickBooks OAuth
+         */
+        addConnection: () => Promise<{
+            authUrl: string;
+            connectionId: string;
+            existingConnections: number;
+        }>;
+        /**
+         * Disconnect a specific QuickBooks account
+         */
+        disconnect: (connectionId: string) => Promise<{
+            success: boolean;
+            message: string;
+        }>;
+    };
+    /**
+     * DayRate (Dynamic Scheduling) namespace
+     * For booking half-day sessions with dynamic pricing
+     */
+    dayrate: {
+        /**
+         * Get available slots with current pricing
+         * Public endpoint - no authentication required
+         */
+        getAvailability: () => Promise<DayrateAvailabilityResponse>;
+        /**
+         * Create a single-slot booking and get Stripe checkout URL
+         * Returns a 10-minute reservation with checkout link
+         */
+        createBooking: (payload: DayrateBookingRequest) => Promise<DayrateBookingResponse>;
+        /**
+         * Create a multi-slot booking and get Stripe checkout URL
+         * Reserves multiple slots with a single checkout session
+         */
+        createMultiBooking: (payload: DayrateMultiBookingRequest) => Promise<DayrateMultiBookingResponse>;
+    };
     createCheckoutSession(priceId: string, successUrl: string, cancelUrl?: string): Promise<{
         data: CheckoutSession;
     }>;
@@ -462,6 +527,12 @@ declare class SPAPSClient<SecureMessageMetadata extends Record<string, any> = Re
     isAuthenticated(): boolean;
     getAccessToken(): string | undefined;
     setAccessToken(token: string): void;
+    setRefreshToken(token: string): void;
+    /**
+     * Restore tokens (for SSO/OAuth flows)
+     * Sets both access and refresh tokens
+     */
+    restoreTokens(accessToken: string, refreshToken?: string): void;
     isLocalMode(): boolean;
     /**
      * Check if current user has admin privileges
@@ -478,6 +549,10 @@ declare class TokenManager {
     private static readonly ACCESS_TOKEN_KEY;
     private static readonly REFRESH_TOKEN_KEY;
     private static readonly USER_KEY;
+    /**
+     * Cross-platform base64 decode (works in both Node.js and browser)
+     */
+    private static base64Decode;
     private static getStorage;
     static storeTokens(tokens: AuthResponse): void;
     static getAccessToken(): string | null;
@@ -486,6 +561,24 @@ declare class TokenManager {
     static clearTokens(): void;
     static isTokenExpired(token: string): boolean;
     static autoRefreshToken(sdk: SPAPSClient): Promise<boolean>;
+    /**
+     * Parse auth tokens from URL fragment (for OAuth callbacks)
+     * URL format: https://app.com/callback#access_token=xxx&refresh_token=xxx
+     */
+    static parseTokensFromUrlFragment(url?: string): {
+        access_token?: string;
+        refresh_token?: string;
+        user_id?: string;
+    } | null;
+    /**
+     * Handle OAuth callback - parse tokens from URL and store them
+     * Returns user info decoded from JWT, or null if no tokens found
+     */
+    static handleOAuthCallback(sdk: SPAPSClient): {
+        id: string;
+        email?: string;
+        role?: string;
+    } | null;
 }
 declare class WalletUtils {
     static detectChainType(address: string): 'solana' | 'ethereum' | 'bitcoin' | null;

package/dist/index.js

@@ -470,12 +470,24 @@ var SPAPSClient = class {
       return data;
     },
     /**
-     * Verify a magic link token. Does not set access/refresh tokens.
-     * Consumers should redirect or prompt login based on the returned status.
+     * Verify a magic link token and authenticate the user.
+     * Returns full auth response with tokens and auto-stores them.
      */
     verifyMagicLink: async (payload) => {
-      const res = await this.client.post("/api/auth/verify-magic-link", payload);
-      return this.unwrapApiResponse(res, "Failed to verify magic link");
+      const res = await this.client.post("/api/auth/verify-magic-link", {
+        token: payload.token,
+        type: payload.type || "magiclink"
+      });
+      const body = res.data;
+      if (body?.success === false) throw new Error(body?.error?.message || "Magic link verification failed");
+      const data = {
+        access_token: body.tokens?.access_token || body.access_token,
+        refresh_token: body.tokens?.refresh_token || body.refresh_token,
+        user: body.user
+      };
+      this.accessToken = data.access_token;
+      this.refreshToken = data.refresh_token;
+      return data;
     },
     solana: {
       linkWallet: async (payload) => {
@@ -791,6 +803,70 @@ var SPAPSClient = class {
       return this.unwrapApiResponse(res, "Failed to touch session");
     }
   };
+  /**
+   * CFO (QuickBooks) namespace for managing multi-account connections
+   */
+  cfo = {
+    /**
+     * Get all QuickBooks connections for the current user
+     */
+    getConnections: async () => {
+      const res = await this.client.get("/api/cfo/user-connections", this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0);
+      return this.unwrapApiResponse(res, "Failed to get connections");
+    },
+    /**
+     * Get connection status (returns primary connection for backward compatibility)
+     */
+    getStatus: async () => {
+      const res = await this.client.get("/api/cfo/user-status", this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0);
+      return this.unwrapApiResponse(res, "Failed to get status");
+    },
+    /**
+     * Start adding a new QuickBooks connection
+     * Returns auth URL to redirect user to QuickBooks OAuth
+     */
+    addConnection: async () => {
+      const res = await this.client.post("/api/cfo/user-add-connection", {}, this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0);
+      return this.unwrapApiResponse(res, "Failed to start connection");
+    },
+    /**
+     * Disconnect a specific QuickBooks account
+     */
+    disconnect: async (connectionId) => {
+      const res = await this.client.delete(`/api/cfo/user-connections/${connectionId}`, this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0);
+      return this.unwrapApiResponse(res, "Failed to disconnect");
+    }
+  };
+  /**
+   * DayRate (Dynamic Scheduling) namespace
+   * For booking half-day sessions with dynamic pricing
+   */
+  dayrate = {
+    /**
+     * Get available slots with current pricing
+     * Public endpoint - no authentication required
+     */
+    getAvailability: async () => {
+      const res = await this.client.get("/api/dayrate/availability");
+      return this.unwrapApiResponse(res, "Failed to get availability");
+    },
+    /**
+     * Create a single-slot booking and get Stripe checkout URL
+     * Returns a 10-minute reservation with checkout link
+     */
+    createBooking: async (payload) => {
+      const res = await this.client.post("/api/dayrate/book", payload);
+      return this.unwrapApiResponse(res, "Failed to create booking");
+    },
+    /**
+     * Create a multi-slot booking and get Stripe checkout URL
+     * Reserves multiple slots with a single checkout session
+     */
+    createMultiBooking: async (payload) => {
+      const res = await this.client.post("/api/dayrate/book-multi", payload);
+      return this.unwrapApiResponse(res, "Failed to create multi-booking");
+    }
+  };
   // Stripe Methods
   async createCheckoutSession(priceId, successUrl, cancelUrl) {
     return this.client.post("/api/stripe/create-checkout-session", {
@@ -914,6 +990,19 @@ var SPAPSClient = class {
   setAccessToken(token) {
     this.accessToken = token;
   }
+  setRefreshToken(token) {
+    this.refreshToken = token;
+  }
+  /**
+   * Restore tokens (for SSO/OAuth flows)
+   * Sets both access and refresh tokens
+   */
+  restoreTokens(accessToken, refreshToken) {
+    this.accessToken = accessToken;
+    if (refreshToken) {
+      this.refreshToken = refreshToken;
+    }
+  }
   isLocalMode() {
     return this._isLocalMode;
   }
@@ -968,6 +1057,17 @@ var TokenManager = class _TokenManager {
   static ACCESS_TOKEN_KEY = "sweet_potato_access_token";
   static REFRESH_TOKEN_KEY = "sweet_potato_refresh_token";
   static USER_KEY = "sweet_potato_user";
+  /**
+   * Cross-platform base64 decode (works in both Node.js and browser)
+   */
+  static base64Decode(str) {
+    if (typeof Buffer !== "undefined") {
+      return Buffer.from(str, "base64").toString("utf8");
+    } else if (typeof atob !== "undefined") {
+      return atob(str);
+    }
+    throw new Error("No base64 decode method available");
+  }
   static getStorage() {
     if (typeof globalThis !== "undefined" && globalThis.localStorage) return globalThis.localStorage;
     if (typeof globalThis !== "undefined" && globalThis.window?.localStorage) return globalThis.window.localStorage;
@@ -1008,7 +1108,7 @@ var TokenManager = class _TokenManager {
     try {
       const parts = token.split(".");
       if (parts.length !== 3 || !parts[1]) return true;
-      const payload = JSON.parse(atob(parts[1]));
+      const payload = JSON.parse(_TokenManager.base64Decode(parts[1]));
       const now = Math.floor(Date.now() / 1e3);
       return payload.exp < now;
     } catch {
@@ -1032,6 +1132,74 @@ var TokenManager = class _TokenManager {
       return false;
     }
   }
+  /**
+   * Parse auth tokens from URL fragment (for OAuth callbacks)
+   * URL format: https://app.com/callback#access_token=xxx&refresh_token=xxx
+   */
+  static parseTokensFromUrlFragment(url) {
+    let hash;
+    if (url) {
+      try {
+        hash = new URL(url).hash;
+      } catch {
+        return null;
+      }
+    } else if (typeof window !== "undefined") {
+      hash = window.location.hash;
+    } else {
+      return null;
+    }
+    if (!hash || hash.length < 2) return null;
+    const params = new URLSearchParams(hash.substring(1));
+    const access_token = params.get("access_token");
+    const refresh_token = params.get("refresh_token");
+    if (!access_token) return null;
+    return {
+      access_token,
+      refresh_token: refresh_token || void 0,
+      user_id: params.get("user_id") || void 0
+    };
+  }
+  /**
+   * Handle OAuth callback - parse tokens from URL and store them
+   * Returns user info decoded from JWT, or null if no tokens found
+   */
+  static handleOAuthCallback(sdk) {
+    const tokens = _TokenManager.parseTokensFromUrlFragment();
+    if (!tokens?.access_token) {
+      console.debug("[SPAPS] handleOAuthCallback: No access token found in URL fragment");
+      return null;
+    }
+    if (typeof window !== "undefined") {
+      window.history.replaceState(null, "", window.location.pathname + window.location.search);
+    }
+    try {
+      const parts = tokens.access_token.split(".");
+      if (parts.length !== 3 || !parts[1]) {
+        console.warn("[SPAPS] handleOAuthCallback: Invalid JWT format - expected 3 parts");
+        return null;
+      }
+      const payload = JSON.parse(_TokenManager.base64Decode(parts[1]));
+      const user = {
+        id: payload.user_id || payload.sub,
+        email: payload.email,
+        role: payload.role || "user"
+      };
+      _TokenManager.storeTokens({
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token || "",
+        user
+      });
+      sdk.setAccessToken(tokens.access_token);
+      if (tokens.refresh_token) {
+        sdk.setRefreshToken(tokens.refresh_token);
+      }
+      return user;
+    } catch (err) {
+      console.warn("[SPAPS] handleOAuthCallback: Failed to decode JWT", err);
+      return null;
+    }
+  }
 };
 var WalletUtils = class _WalletUtils {
   static detectChainType(address) {

package/dist/index.mjs

@@ -443,12 +443,24 @@ var SPAPSClient = class {
       return data;
     },
     /**
-     * Verify a magic link token. Does not set access/refresh tokens.
-     * Consumers should redirect or prompt login based on the returned status.
+     * Verify a magic link token and authenticate the user.
+     * Returns full auth response with tokens and auto-stores them.
      */
     verifyMagicLink: async (payload) => {
-      const res = await this.client.post("/api/auth/verify-magic-link", payload);
-      return this.unwrapApiResponse(res, "Failed to verify magic link");
+      const res = await this.client.post("/api/auth/verify-magic-link", {
+        token: payload.token,
+        type: payload.type || "magiclink"
+      });
+      const body = res.data;
+      if (body?.success === false) throw new Error(body?.error?.message || "Magic link verification failed");
+      const data = {
+        access_token: body.tokens?.access_token || body.access_token,
+        refresh_token: body.tokens?.refresh_token || body.refresh_token,
+        user: body.user
+      };
+      this.accessToken = data.access_token;
+      this.refreshToken = data.refresh_token;
+      return data;
     },
     solana: {
       linkWallet: async (payload) => {
@@ -764,6 +776,70 @@ var SPAPSClient = class {
       return this.unwrapApiResponse(res, "Failed to touch session");
     }
   };
+  /**
+   * CFO (QuickBooks) namespace for managing multi-account connections
+   */
+  cfo = {
+    /**
+     * Get all QuickBooks connections for the current user
+     */
+    getConnections: async () => {
+      const res = await this.client.get("/api/cfo/user-connections", this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0);
+      return this.unwrapApiResponse(res, "Failed to get connections");
+    },
+    /**
+     * Get connection status (returns primary connection for backward compatibility)
+     */
+    getStatus: async () => {
+      const res = await this.client.get("/api/cfo/user-status", this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0);
+      return this.unwrapApiResponse(res, "Failed to get status");
+    },
+    /**
+     * Start adding a new QuickBooks connection
+     * Returns auth URL to redirect user to QuickBooks OAuth
+     */
+    addConnection: async () => {
+      const res = await this.client.post("/api/cfo/user-add-connection", {}, this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0);
+      return this.unwrapApiResponse(res, "Failed to start connection");
+    },
+    /**
+     * Disconnect a specific QuickBooks account
+     */
+    disconnect: async (connectionId) => {
+      const res = await this.client.delete(`/api/cfo/user-connections/${connectionId}`, this.accessToken ? { headers: { Authorization: `Bearer ${this.accessToken}` } } : void 0);
+      return this.unwrapApiResponse(res, "Failed to disconnect");
+    }
+  };
+  /**
+   * DayRate (Dynamic Scheduling) namespace
+   * For booking half-day sessions with dynamic pricing
+   */
+  dayrate = {
+    /**
+     * Get available slots with current pricing
+     * Public endpoint - no authentication required
+     */
+    getAvailability: async () => {
+      const res = await this.client.get("/api/dayrate/availability");
+      return this.unwrapApiResponse(res, "Failed to get availability");
+    },
+    /**
+     * Create a single-slot booking and get Stripe checkout URL
+     * Returns a 10-minute reservation with checkout link
+     */
+    createBooking: async (payload) => {
+      const res = await this.client.post("/api/dayrate/book", payload);
+      return this.unwrapApiResponse(res, "Failed to create booking");
+    },
+    /**
+     * Create a multi-slot booking and get Stripe checkout URL
+     * Reserves multiple slots with a single checkout session
+     */
+    createMultiBooking: async (payload) => {
+      const res = await this.client.post("/api/dayrate/book-multi", payload);
+      return this.unwrapApiResponse(res, "Failed to create multi-booking");
+    }
+  };
   // Stripe Methods
   async createCheckoutSession(priceId, successUrl, cancelUrl) {
     return this.client.post("/api/stripe/create-checkout-session", {
@@ -887,6 +963,19 @@ var SPAPSClient = class {
   setAccessToken(token) {
     this.accessToken = token;
   }
+  setRefreshToken(token) {
+    this.refreshToken = token;
+  }
+  /**
+   * Restore tokens (for SSO/OAuth flows)
+   * Sets both access and refresh tokens
+   */
+  restoreTokens(accessToken, refreshToken) {
+    this.accessToken = accessToken;
+    if (refreshToken) {
+      this.refreshToken = refreshToken;
+    }
+  }
   isLocalMode() {
     return this._isLocalMode;
   }
@@ -941,6 +1030,17 @@ var TokenManager = class _TokenManager {
   static ACCESS_TOKEN_KEY = "sweet_potato_access_token";
   static REFRESH_TOKEN_KEY = "sweet_potato_refresh_token";
   static USER_KEY = "sweet_potato_user";
+  /**
+   * Cross-platform base64 decode (works in both Node.js and browser)
+   */
+  static base64Decode(str) {
+    if (typeof Buffer !== "undefined") {
+      return Buffer.from(str, "base64").toString("utf8");
+    } else if (typeof atob !== "undefined") {
+      return atob(str);
+    }
+    throw new Error("No base64 decode method available");
+  }
   static getStorage() {
     if (typeof globalThis !== "undefined" && globalThis.localStorage) return globalThis.localStorage;
     if (typeof globalThis !== "undefined" && globalThis.window?.localStorage) return globalThis.window.localStorage;
@@ -981,7 +1081,7 @@ var TokenManager = class _TokenManager {
     try {
       const parts = token.split(".");
       if (parts.length !== 3 || !parts[1]) return true;
-      const payload = JSON.parse(atob(parts[1]));
+      const payload = JSON.parse(_TokenManager.base64Decode(parts[1]));
       const now = Math.floor(Date.now() / 1e3);
       return payload.exp < now;
     } catch {
@@ -1005,6 +1105,74 @@ var TokenManager = class _TokenManager {
       return false;
     }
   }
+  /**
+   * Parse auth tokens from URL fragment (for OAuth callbacks)
+   * URL format: https://app.com/callback#access_token=xxx&refresh_token=xxx
+   */
+  static parseTokensFromUrlFragment(url) {
+    let hash;
+    if (url) {
+      try {
+        hash = new URL(url).hash;
+      } catch {
+        return null;
+      }
+    } else if (typeof window !== "undefined") {
+      hash = window.location.hash;
+    } else {
+      return null;
+    }
+    if (!hash || hash.length < 2) return null;
+    const params = new URLSearchParams(hash.substring(1));
+    const access_token = params.get("access_token");
+    const refresh_token = params.get("refresh_token");
+    if (!access_token) return null;
+    return {
+      access_token,
+      refresh_token: refresh_token || void 0,
+      user_id: params.get("user_id") || void 0
+    };
+  }
+  /**
+   * Handle OAuth callback - parse tokens from URL and store them
+   * Returns user info decoded from JWT, or null if no tokens found
+   */
+  static handleOAuthCallback(sdk) {
+    const tokens = _TokenManager.parseTokensFromUrlFragment();
+    if (!tokens?.access_token) {
+      console.debug("[SPAPS] handleOAuthCallback: No access token found in URL fragment");
+      return null;
+    }
+    if (typeof window !== "undefined") {
+      window.history.replaceState(null, "", window.location.pathname + window.location.search);
+    }
+    try {
+      const parts = tokens.access_token.split(".");
+      if (parts.length !== 3 || !parts[1]) {
+        console.warn("[SPAPS] handleOAuthCallback: Invalid JWT format - expected 3 parts");
+        return null;
+      }
+      const payload = JSON.parse(_TokenManager.base64Decode(parts[1]));
+      const user = {
+        id: payload.user_id || payload.sub,
+        email: payload.email,
+        role: payload.role || "user"
+      };
+      _TokenManager.storeTokens({
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token || "",
+        user
+      });
+      sdk.setAccessToken(tokens.access_token);
+      if (tokens.refresh_token) {
+        sdk.setRefreshToken(tokens.refresh_token);
+      }
+      return user;
+    } catch (err) {
+      console.warn("[SPAPS] handleOAuthCallback: Failed to decode JWT", err);
+      return null;
+    }
+  }
 };
 var WalletUtils = class _WalletUtils {
   static detectChainType(address) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "spaps-sdk",
-  "version": "1.2.0",
-  "description": "Sweet Potato Authentication & Payment Service SDK - Zero-config client with built-in permission checking and role-based access control",
+  "version": "1.3.0",
+  "description": "Sweet Potato Authentication & Payment Service SDK - Zero-config client with built-in permission checking, role-based access control, and dayrate scheduling",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -31,7 +31,9 @@
     "sdk",
     "client",
     "sweet-potato",
-    "wallet-auth"
+    "wallet-auth",
+    "dayrate",
+    "scheduling"
   ],
   "author": "buildooor",
   "license": "UNLICENSED",
@@ -44,7 +46,7 @@
     "email": "buildooor@gmail.com"
   },
   "dependencies": {
-    "spaps-types": "^1.0.58",
+    "spaps-types": "^1.0.59",
     "axios": "^1.6.0",
     "cross-fetch": "^4.0.0"
   },