@acms-subir/client 0.1.3 → 0.1.5

package/README.md

@@ -31,11 +31,12 @@ the cache and transport configuration with the original client.
 | --- | --- |
 | `site()`, `theme()`, `home()` | Identity, tokens, resolved homepage |
 | `page(slug, opts)` | Resolved page including sections; nested slugs supported |
-| `content(opts)` | `kind`, `collection`, `page`, `limit`, `cursor` |
+| `content(opts)` | `kind`, `collection`, `q`, `page`, `limit`, `cursor` |
 | `contentById(id, opts)` | Optional `kind` to disambiguate imported IDs |
-| `posts(opts)` | Content filtered to posts; `collection`, `tag`, pagination |
+| `posts(opts)` | Content filtered to posts; `collection`, `tag`, `q`, pagination |
 | `post(slug, opts)` | Scans post summaries, then loads detail by ID; pass `collection` for ambiguous slugs |
 | `pages(opts)` | Page **summaries**, with pagination; use `page()` for sections |
+| `search(text, opts)` | Top matches in `posts`, `pages` and `events`, plus `more` per group; `types`, `collection`, `limit` (1–20, default 5). Blank text resolves empty without a request |
 | `events(opts)` | Occurrences with `from`, `to`, `calendar`, `q`, pagination |
 | `event(slug, opts)` | First matching event from occurrences in the requested window |
 | `calendars()` | Public calendars |
@@ -47,6 +48,12 @@ the cache and transport configuration with the original client.
 | `updateDevice(token, { topics?, locale? })` | Change a device's topics or language |
 | `unregisterDevice(token)` | Opt out (idempotent) |
 | `pushTopics()` | Topics to offer as notification toggles |
+| `links()` | The links page: profile, socials and visible blocks (`link`, `email`, `phone`, `contact`, `heading`, `text`, `spacer`, `live`, `embed`) |
+| `form(id)`, `submitForm(id, { answers, version?, idempotencyKey? })` | A published form's questions; send answers (checkbox groups as arrays). Each call makes one key; retries reuse it |
+| `manageBooking(token)`, `cancelBooking(token)` | The booker's own booking from its `manageToken`, and cancelling it; `can` says what is allowed |
+| `rescheduleAvailability(token, { from?, days?, minutes? })`, `rescheduleBooking(token, { start, minutes? })` | Open times for moving it (its own time counts as free), then the move |
+| `bookingIcs(token)` | The booking as an iCalendar file (string) |
+| `requestGuestCode(email)`, `guestSignIn({ email, code, deviceName? })`, `guestBookings(guestToken, { when? })`, `guestSignOut(guestToken)` | Guest sign-in for "My bookings" |
 
 The server has no post-slug, event-detail or resource-detail endpoint. Those
 convenience methods may make multiple requests. `event()` only finds events
@@ -54,6 +61,17 @@ with occurrences in its window (default: next 30 UTC days); an unlisted
 calendar requires `calendar`. It does not fetch arbitrary historical events.
 If post slugs collide and no collection is supplied, the first listed match wins.
 
+Search needs `site.features.search` (on unless the site sets
+`acms({ search: { enabled: false } })`). It uses the website's search index and
+ranking: titles count most, then excerpts, tags and body text. Every word
+must match, and the last one matches as a prefix (`birth` finds "birthday"). `q` on `content()`/`posts()` returns
+ranked summaries, posts before pages, and pages through at most 200 matches per
+kind. `search()` is for a combined results screen: each hit carries a plain-text
+`snippet` with `highlights` (`{ start, end }` ranges) to bold, and events add
+their next `occurrence`. Use `more.posts` to offer "See all", then
+`posts({ q, collection })`. Matching uses the main-language text, so a
+translated title is shown but not searched.
+
 Pagination uses `page`/`nextPage`, not opaque cursors. `cursor` is a numeric
 alias for `page`; an explicit `page` wins. `tag` filters **each fetched page
 locally**, so a page can be empty with a non-null `nextPage`. Iterators continue
@@ -86,9 +104,14 @@ controller.abort();
 await pending.catch(() => {});
 ```
 
-GET and booking POST requests retry network failures, 5xx and 429 responses at
-most twice (three attempts total), with 250/500ms backoff and at least the
-server's `Retry-After` delay (seconds or HTTP date). Booking retries always
+Requests that are safe to repeat (GET, PUT, DELETE, device registration, and
+POSTs with an Idempotency-Key: bookings and form responses) retry network
+failures, 5xx and 429 responses at most twice (three attempts total), with
+250/500ms backoff and at least the server's `Retry-After` delay (seconds or HTTP
+date). A wait that would outlast `timeoutMs` throws the 429 straight away, with
+`retryAfter`. One-shot writes (guest code requests and sign-in, cancelling and
+moving a booking, guest sign-out) are never repeated automatically: on a
+network error, check the state before trying again. Booking retries always
 reuse the same serialized body and UUID. By default each `book()` call creates
 a key using `crypto.randomUUID`, falling back to a Math.random UUID v4 where
 unavailable. For recovery across calls/app restarts, supply and persist your own
@@ -155,6 +178,29 @@ and checks generated request/response types byte-for-byte. HEAD and OPTIONS
 are transport operations and have no separate data-returning methods. No core
 code, Zod, or Node built-ins ship in this package's runtime.
 
+## Managing bookings and "My bookings"
+
+```ts
+// a booking the app made (result.manageToken from book()), or one from guestBookings()
+const view = await client.manageBooking(manageToken);
+if (view.can.reschedule) {
+  const open = await client.rescheduleAvailability(manageToken, { days: 7 });
+  await client.rescheduleBooking(manageToken, { start: open.days[0].slots[0].start });
+}
+if (view.can.cancel) await client.cancelBooking(manageToken);
+
+// guest sign-in (check site.features.guestSignIn first)
+await client.requestGuestCode('ana@example.com');
+const { accessToken } = await client.guestSignIn({ email: 'ana@example.com', code: '481203' });
+const mine = await client.guestBookings(accessToken, { when: 'upcoming' });
+```
+
+Booking and guest tokens travel in headers (`Booking-Token`,
+`Authorization: Bearer`), never in URLs, and their responses are never cached.
+Keep both in secure storage (`expo-secure-store`). `can.closed` means the
+booking type's change cutoff has passed: show "Contact us" instead of the
+buttons. A guest token ends after 90 days unused; 401 means sign in again.
+
 ## Editor apps (staff sign-in)
 
 For sites with `acms({ mobile: { editor: { redirectUris } } })`. Staff sign in
@@ -180,3 +226,14 @@ In React Native pass `crypto: { randomBytes, sha256 }` from expo-crypto to
 `createEditorAuth` (Web Crypto is the default). Refreshes are single-flight;
 a 401 is retried once after a refresh, then `onAuthError` runs. Writes carry
 the `revision` you loaded (409 when someone saved first).
+
+Schedule and setup: `schedule({ from, to, resource? })` (up to 63 days of
+bookings, blocked time, events and feeds), `createBooking()` (on someone's
+behalf), `rescheduleBooking(id, …)`, `listResources()` / `getResource()` /
+`createResource()` / `updateResource()` / `deleteResource()`,
+`createBookingLink()` / `updateBookingLink()` / `deleteBookingLink()`,
+`blockTime()` / `unblockTime()`, `listCalendars()` / `createCalendar()` /
+`updateCalendar()` / `deleteCalendar()`, `listForms()` /
+`listFormResponses()`, `getLinksPage()` / `saveLinksPage()`. Setup writes need
+`me().permissions.schedule.manage`; form responses and HTML link blocks need
+an administrator or owner (403 otherwise).

package/dist/editor.d.ts

@@ -1,5 +1,5 @@
 import { AcmsError } from './errors.js';
-import type { EditorToken, EditorMe, EditorDocumentList, EditorDocument, EditorSections, EditorSectionResult, EditorRevision, EditorDocumentTranslation, EditorSectionTranslation, EditorMedia, EditorMediaList, EditorBooking, EditorBookingList, EditorCreateInput, EditorSaveInput, EditorListQuery, EditorSectionsQuery, EditorMediaQuery, EditorBookingsQuery } from './types.js';
+import type { EditorToken, EditorMe, EditorDocumentList, EditorDocument, EditorSections, EditorSectionResult, EditorRevision, EditorDocumentTranslation, EditorSectionTranslation, EditorMedia, EditorMediaList, EditorBooking, EditorBookingList, EditorCreateInput, EditorSaveInput, EditorListQuery, EditorSectionsQuery, EditorMediaQuery, EditorBookingsQuery, EditorSchedule, EditorScheduleQuery, EditorStaffBookingInput, EditorRescheduleInput, EditorResource, EditorResourceList, EditorResourceInput, EditorResourcePatch, EditorBookingLink, EditorLinkInput, EditorLinkPatch, EditorBlock, EditorBlockInput, EditorCalendar, EditorCalendarList, EditorCalendarInput, EditorCalendarPatch, EditorDeleted, EditorFormList, EditorFormResponses, EditorResponsesQuery, EditorLinksPage, EditorLinksPut } from './types.js';
 /** Randomness + SHA-256. Defaults to Web Crypto; in React Native pass expo-crypto:
  *  { randomBytes: (n) => Crypto.getRandomBytes(n), sha256: (d) => Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA256, d) } */
 export interface PkceCrypto {
@@ -201,6 +201,90 @@ export declare const editorEndpoints: {
         readonly method: "POST";
         readonly path: "/admin/bookings/{id}/cancel";
     };
+    readonly createBooking: {
+        readonly method: "POST";
+        readonly path: "/admin/bookings";
+    };
+    readonly rescheduleBooking: {
+        readonly method: "POST";
+        readonly path: "/admin/bookings/{id}/reschedule";
+    };
+    readonly schedule: {
+        readonly method: "GET";
+        readonly path: "/admin/schedule";
+    };
+    readonly listResources: {
+        readonly method: "GET";
+        readonly path: "/admin/resources";
+    };
+    readonly createResource: {
+        readonly method: "POST";
+        readonly path: "/admin/resources";
+    };
+    readonly getResource: {
+        readonly method: "GET";
+        readonly path: "/admin/resources/{id}";
+    };
+    readonly updateResource: {
+        readonly method: "PATCH";
+        readonly path: "/admin/resources/{id}";
+    };
+    readonly deleteResource: {
+        readonly method: "DELETE";
+        readonly path: "/admin/resources/{id}";
+    };
+    readonly createBookingLink: {
+        readonly method: "POST";
+        readonly path: "/admin/resources/{id}/links";
+    };
+    readonly updateBookingLink: {
+        readonly method: "PATCH";
+        readonly path: "/admin/resources/{id}/links/{linkId}";
+    };
+    readonly deleteBookingLink: {
+        readonly method: "DELETE";
+        readonly path: "/admin/resources/{id}/links/{linkId}";
+    };
+    readonly blockTime: {
+        readonly method: "POST";
+        readonly path: "/admin/resources/{id}/blocks";
+    };
+    readonly unblockTime: {
+        readonly method: "DELETE";
+        readonly path: "/admin/resources/{id}/blocks/{blockId}";
+    };
+    readonly listCalendars: {
+        readonly method: "GET";
+        readonly path: "/admin/calendars";
+    };
+    readonly createCalendar: {
+        readonly method: "POST";
+        readonly path: "/admin/calendars";
+    };
+    readonly updateCalendar: {
+        readonly method: "PATCH";
+        readonly path: "/admin/calendars/{id}";
+    };
+    readonly deleteCalendar: {
+        readonly method: "DELETE";
+        readonly path: "/admin/calendars/{id}";
+    };
+    readonly listForms: {
+        readonly method: "GET";
+        readonly path: "/admin/forms";
+    };
+    readonly listFormResponses: {
+        readonly method: "GET";
+        readonly path: "/admin/forms/{id}/responses";
+    };
+    readonly getLinksPage: {
+        readonly method: "GET";
+        readonly path: "/admin/links";
+    };
+    readonly saveLinksPage: {
+        readonly method: "PUT";
+        readonly path: "/admin/links";
+    };
 };
 export type DocKind = 'post' | 'page' | 'event';
 /** React Native's FormData file shape, or a Blob/File on the web and Node */
@@ -287,5 +371,31 @@ export declare function createEditorClient(options: EditorClientOptions): {
     cancelBooking: (id: string, input?: {
         message?: string;
     }, o?: EditorRequestOptions) => Promise<EditorBooking>;
+    /** book on someone's behalf; ignoreRules needs an administrator or owner (see me().permissions.schedule) */
+    createBooking: (input: EditorStaffBookingInput, o?: EditorRequestOptions) => Promise<EditorBooking>;
+    rescheduleBooking: (id: string, input: EditorRescheduleInput, o?: EditorRequestOptions) => Promise<EditorBooking>;
+    /** bookings, blocked time, events and subscribed calendars; from/to are site-local days, up to 63 days */
+    schedule: (q: EditorScheduleQuery, o?: EditorRequestOptions) => Promise<EditorSchedule>;
+    listResources: (o?: EditorRequestOptions) => Promise<EditorResourceList>;
+    getResource: (id: string, o?: EditorRequestOptions) => Promise<EditorResource>;
+    createResource: (input: EditorResourceInput, o?: EditorRequestOptions) => Promise<EditorResource>;
+    updateResource: (id: string, input: EditorResourcePatch, o?: EditorRequestOptions) => Promise<EditorResource>;
+    deleteResource: (id: string, o?: EditorRequestOptions) => Promise<EditorDeleted>;
+    createBookingLink: (resourceId: string, input: EditorLinkInput, o?: EditorRequestOptions) => Promise<EditorBookingLink>;
+    updateBookingLink: (resourceId: string, linkId: string, input: EditorLinkPatch, o?: EditorRequestOptions) => Promise<EditorBookingLink>;
+    deleteBookingLink: (resourceId: string, linkId: string, o?: EditorRequestOptions) => Promise<EditorDeleted>;
+    blockTime: (resourceId: string, input: EditorBlockInput, o?: EditorRequestOptions) => Promise<EditorBlock>;
+    unblockTime: (resourceId: string, blockId: string, o?: EditorRequestOptions) => Promise<EditorDeleted>;
+    listCalendars: (o?: EditorRequestOptions) => Promise<EditorCalendarList>;
+    createCalendar: (input: EditorCalendarInput, o?: EditorRequestOptions) => Promise<EditorCalendar>;
+    updateCalendar: (id: string, input: EditorCalendarPatch, o?: EditorRequestOptions) => Promise<EditorCalendar>;
+    deleteCalendar: (id: string, o?: EditorRequestOptions) => Promise<EditorDeleted>;
+    listForms: (o?: EditorRequestOptions) => Promise<EditorFormList>;
+    /** administrators and owners only (me().permissions.forms.readResponses) */
+    listFormResponses: (id: string, q?: EditorResponsesQuery, o?: EditorRequestOptions) => Promise<EditorFormResponses>;
+    getLinksPage: (o?: EditorRequestOptions) => Promise<EditorLinksPage>;
+    /** replaces the whole page: send every block in order (omit id for new ones) */
+    /** send the `revision` from linksPage(); 409 when the page changed since (nothing saved) */
+    saveLinksPage: (input: EditorLinksPut, o?: EditorRequestOptions) => Promise<EditorLinksPage>;
 };
 export type EditorClient = ReturnType<typeof createEditorClient>;

package/dist/editor.js

@@ -220,6 +220,21 @@ export const editorEndpoints = {
     approveBooking: { method: 'POST', path: '/admin/bookings/{id}/approve' },
     declineBooking: { method: 'POST', path: '/admin/bookings/{id}/decline' },
     cancelBooking: { method: 'POST', path: '/admin/bookings/{id}/cancel' },
+    createBooking: { method: 'POST', path: '/admin/bookings' },
+    rescheduleBooking: { method: 'POST', path: '/admin/bookings/{id}/reschedule' },
+    schedule: { method: 'GET', path: '/admin/schedule' },
+    listResources: { method: 'GET', path: '/admin/resources' }, createResource: { method: 'POST', path: '/admin/resources' },
+    getResource: { method: 'GET', path: '/admin/resources/{id}' }, updateResource: { method: 'PATCH', path: '/admin/resources/{id}' },
+    deleteResource: { method: 'DELETE', path: '/admin/resources/{id}' },
+    createBookingLink: { method: 'POST', path: '/admin/resources/{id}/links' },
+    updateBookingLink: { method: 'PATCH', path: '/admin/resources/{id}/links/{linkId}' },
+    deleteBookingLink: { method: 'DELETE', path: '/admin/resources/{id}/links/{linkId}' },
+    blockTime: { method: 'POST', path: '/admin/resources/{id}/blocks' },
+    unblockTime: { method: 'DELETE', path: '/admin/resources/{id}/blocks/{blockId}' },
+    listCalendars: { method: 'GET', path: '/admin/calendars' }, createCalendar: { method: 'POST', path: '/admin/calendars' },
+    updateCalendar: { method: 'PATCH', path: '/admin/calendars/{id}' }, deleteCalendar: { method: 'DELETE', path: '/admin/calendars/{id}' },
+    listForms: { method: 'GET', path: '/admin/forms' }, listFormResponses: { method: 'GET', path: '/admin/forms/{id}/responses' },
+    getLinksPage: { method: 'GET', path: '/admin/links' }, saveLinksPage: { method: 'PUT', path: '/admin/links' },
 };
 export function createEditorClient(options) {
     const { api } = origin(options.baseUrl);
@@ -350,5 +365,32 @@ export function createEditorClient(options) {
         approveBooking: (id, input = {}, o) => call('approveBooking', { id }, { ...R(o), body: input }),
         declineBooking: (id, input = {}, o) => call('declineBooking', { id }, { ...R(o), body: input }),
         cancelBooking: (id, input = {}, o) => call('cancelBooking', { id }, { ...R(o), body: input }),
+        /** book on someone's behalf; ignoreRules needs an administrator or owner (see me().permissions.schedule) */
+        createBooking: (input, o) => call('createBooking', {}, { ...R(o), body: input }),
+        rescheduleBooking: (id, input, o) => call('rescheduleBooking', { id }, { ...R(o), body: input }),
+        /** bookings, blocked time, events and subscribed calendars; from/to are site-local days, up to 63 days */
+        schedule: (q, o) => call('schedule', {}, { ...R(o), query: q }),
+        listResources: (o) => call('listResources', {}, R(o)),
+        getResource: (id, o) => call('getResource', { id }, R(o)),
+        // setup writes need me().permissions.schedule.manage (403 otherwise)
+        createResource: (input, o) => call('createResource', {}, { ...R(o), body: input }),
+        updateResource: (id, input, o) => call('updateResource', { id }, { ...R(o), body: input }),
+        deleteResource: (id, o) => call('deleteResource', { id }, R(o)),
+        createBookingLink: (resourceId, input, o) => call('createBookingLink', { id: resourceId }, { ...R(o), body: input }),
+        updateBookingLink: (resourceId, linkId, input, o) => call('updateBookingLink', { id: resourceId, linkId }, { ...R(o), body: input }),
+        deleteBookingLink: (resourceId, linkId, o) => call('deleteBookingLink', { id: resourceId, linkId }, R(o)),
+        blockTime: (resourceId, input, o) => call('blockTime', { id: resourceId }, { ...R(o), body: input }),
+        unblockTime: (resourceId, blockId, o) => call('unblockTime', { id: resourceId, blockId }, R(o)),
+        listCalendars: (o) => call('listCalendars', {}, R(o)),
+        createCalendar: (input, o) => call('createCalendar', {}, { ...R(o), body: input }),
+        updateCalendar: (id, input, o) => call('updateCalendar', { id }, { ...R(o), body: input }),
+        deleteCalendar: (id, o) => call('deleteCalendar', { id }, R(o)),
+        listForms: (o) => call('listForms', {}, R(o)),
+        /** administrators and owners only (me().permissions.forms.readResponses) */
+        listFormResponses: (id, q = {}, o) => call('listFormResponses', { id }, { ...R(o), query: q }),
+        getLinksPage: (o) => call('getLinksPage', {}, R(o)),
+        /** replaces the whole page: send every block in order (omit id for new ones) */
+        /** send the `revision` from linksPage(); 409 when the page changed since (nothing saved) */
+        saveLinksPage: (input, o) => call('saveLinksPage', {}, { ...R(o), body: input }),
     };
 }

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { Site, Theme, Page, Content, Post, ContentList, Events, Event, Calendars, Resources, Resource, Availability, BookingInput, BookingResult, Device, DeviceInput, DeviceUpdate, DeviceRegistration, DeviceRemoved, PushTopics } from './types.js';
+import type { Site, Theme, Page, Content, Post, ContentList, SearchResults, Links, Form, FormReceipt, FormResponseInput, ManagedBooking, RescheduleInput, ManageAvailabilityQuery, GuestCodeSent, GuestToken, GuestBookings, GuestBookingsQuery, GuestSignedOut, Events, Event, Calendars, Resources, Resource, Availability, BookingInput, BookingResult, Device, DeviceInput, DeviceUpdate, DeviceRegistration, DeviceRemoved, PushTopics } from './types.js';
 export { AcmsError, isAcmsError } from './errors.js';
 export type * from './types.js';
 export * from './editor.js';
@@ -14,6 +14,8 @@ export interface ListOptions extends RequestOptions {
 export interface ContentOptions extends ListOptions {
     kind?: 'post' | 'page';
     collection?: string;
+    /** Search text (up to 100 characters): ranked matches instead of newest first, posts before pages. Blank means no search. Requires `site.features.search`. */
+    q?: string;
 }
 export interface PostOptions extends Omit<ContentOptions, 'kind'> {
     tag?: string;
@@ -30,6 +32,14 @@ export interface EventOptions extends ListOptions {
     calendar?: string;
     q?: string;
 }
+export interface SearchOptions extends RequestOptions {
+    /** Which groups to search; default all three. */
+    types?: Array<'post' | 'page' | 'event'>;
+    /** Only posts in this collection (pages and events are skipped). */
+    collection?: string;
+    /** Matches per group, 1–20; default 5. */
+    limit?: number;
+}
 export interface AvailabilityOptions extends RequestOptions {
     resource: string;
     link: string;
@@ -94,6 +104,10 @@ export declare const endpoints: {
         readonly method: "GET";
         readonly path: "/content/{id}";
     };
+    readonly search: {
+        readonly method: "GET";
+        readonly path: "/search";
+    };
     readonly events: {
         readonly method: "GET";
         readonly path: "/events";
@@ -134,6 +148,54 @@ export declare const endpoints: {
         readonly method: "GET";
         readonly path: "/push/topics";
     };
+    readonly links: {
+        readonly method: "GET";
+        readonly path: "/links";
+    };
+    readonly form: {
+        readonly method: "GET";
+        readonly path: "/forms/{id}";
+    };
+    readonly submitForm: {
+        readonly method: "POST";
+        readonly path: "/forms/{id}/responses";
+    };
+    readonly manageBooking: {
+        readonly method: "GET";
+        readonly path: "/bookings/manage";
+    };
+    readonly cancelBooking: {
+        readonly method: "POST";
+        readonly path: "/bookings/manage/cancel";
+    };
+    readonly rescheduleAvailability: {
+        readonly method: "GET";
+        readonly path: "/bookings/manage/availability";
+    };
+    readonly rescheduleBooking: {
+        readonly method: "POST";
+        readonly path: "/bookings/manage/reschedule";
+    };
+    readonly bookingIcs: {
+        readonly method: "GET";
+        readonly path: "/bookings/manage/ics";
+    };
+    readonly requestGuestCode: {
+        readonly method: "POST";
+        readonly path: "/guest/code";
+    };
+    readonly guestSignIn: {
+        readonly method: "POST";
+        readonly path: "/guest/token";
+    };
+    readonly guestBookings: {
+        readonly method: "GET";
+        readonly path: "/guest/bookings";
+    };
+    readonly guestSignOut: {
+        readonly method: "POST";
+        readonly path: "/guest/revoke";
+    };
 };
 export declare function createClient(options: ClientOptions): AcmsClient;
 export interface AcmsClient {
@@ -150,6 +212,8 @@ export interface AcmsClient {
         collection?: string;
     }): Promise<Post>;
     pages(o?: ListOptions): Promise<ContentList>;
+    /** Ranked matches across posts, pages and events, the top few per group. Requires `site.features.search`. */
+    search(q: string, o?: SearchOptions): Promise<SearchResults>;
     events(o?: EventOptions): Promise<Events>;
     event(slug: string, o?: EventOptions): Promise<Event>;
     calendars(o?: RequestOptions): Promise<Calendars>;
@@ -166,6 +230,33 @@ export interface AcmsClient {
     unregisterDevice(token: string, o?: RequestOptions): Promise<DeviceRemoved>;
     /** Topics the app can offer as notification toggles. */
     pushTopics(o?: RequestOptions): Promise<PushTopics>;
+    /** The links page: profile, socials and visible blocks. Requires `site.features.links`. */
+    links(o?: RequestOptions): Promise<Links>;
+    /** A published form's questions. 410 when it stopped accepting responses. Requires `site.features.forms`. */
+    form(id: string, o?: RequestOptions): Promise<Form>;
+    /** Send answers (checkbox groups as arrays). Retries reuse the same Idempotency-Key, so they never duplicate. */
+    submitForm(id: string, input: FormResponseInput & {
+        idempotencyKey?: string;
+    }, o?: RequestOptions): Promise<FormReceipt>;
+    /** The booker's own booking, from its private token (`manageToken`). Never cached. Requires `site.features.bookingChanges`. */
+    manageBooking(token: string, o?: RequestOptions): Promise<ManagedBooking>;
+    cancelBooking(token: string, o?: RequestOptions): Promise<ManagedBooking>;
+    /** Open times for moving the booking (its own time counts as free). */
+    rescheduleAvailability(token: string, q?: ManageAvailabilityQuery, o?: RequestOptions): Promise<Availability>;
+    rescheduleBooking(token: string, input: RescheduleInput, o?: RequestOptions): Promise<ManagedBooking>;
+    /** The booking as an iCalendar file (text). */
+    bookingIcs(token: string, o?: RequestOptions): Promise<string>;
+    /** Email a 6-digit sign-in code. Always resolves the same way. Requires `site.features.guestSignIn`. */
+    requestGuestCode(email: string, o?: RequestOptions): Promise<GuestCodeSent>;
+    /** Email + code → guest token. Keep it in secure storage; it ends after 90 days unused. */
+    guestSignIn(input: {
+        email: string;
+        code: string;
+        deviceName?: string;
+    }, o?: RequestOptions): Promise<GuestToken>;
+    /** Bookings and RSVPs for the signed-in email; each has a `manageToken` for the methods above. */
+    guestBookings(guestToken: string, q?: GuestBookingsQuery, o?: RequestOptions): Promise<GuestBookings>;
+    guestSignOut(guestToken: string, o?: RequestOptions): Promise<GuestSignedOut>;
     withLocale(locale: string): AcmsClient;
     paginate: {
         content(o?: ContentOptions): AsyncGenerator<ContentList['items'][number]>;

package/dist/index.js

@@ -6,14 +6,24 @@ export const endpoints = {
     site: { method: 'GET', path: '/site' }, theme: { method: 'GET', path: '/theme' },
     home: { method: 'GET', path: '/pages/home' }, page: { method: 'GET', path: '/pages/{slug}' },
     content: { method: 'GET', path: '/content' }, contentById: { method: 'GET', path: '/content/{id}' },
+    search: { method: 'GET', path: '/search' },
     events: { method: 'GET', path: '/events' }, calendars: { method: 'GET', path: '/calendars' },
     resources: { method: 'GET', path: '/resources' }, availability: { method: 'GET', path: '/availability' },
     book: { method: 'POST', path: '/bookings' }, openapi: { method: 'GET', path: '/openapi.json' },
     // push notifications (only when the site enables push; 404 otherwise)
     registerDevice: { method: 'POST', path: '/devices' }, updateDevice: { method: 'PUT', path: '/devices/{token}' },
     unregisterDevice: { method: 'DELETE', path: '/devices/{token}' }, pushTopics: { method: 'GET', path: '/push/topics' },
+    // links page and forms (owner switches in Admin → Mobile app)
+    links: { method: 'GET', path: '/links' }, form: { method: 'GET', path: '/forms/{id}' }, submitForm: { method: 'POST', path: '/forms/{id}/responses' },
+    // the booker's own booking: its private token goes in the Booking-Token header
+    manageBooking: { method: 'GET', path: '/bookings/manage' }, cancelBooking: { method: 'POST', path: '/bookings/manage/cancel' },
+    rescheduleAvailability: { method: 'GET', path: '/bookings/manage/availability' }, rescheduleBooking: { method: 'POST', path: '/bookings/manage/reschedule' },
+    bookingIcs: { method: 'GET', path: '/bookings/manage/ics' },
+    // guest sign-in for "My bookings" (emailed code → guest token)
+    requestGuestCode: { method: 'POST', path: '/guest/code' }, guestSignIn: { method: 'POST', path: '/guest/token' },
+    guestBookings: { method: 'GET', path: '/guest/bookings' }, guestSignOut: { method: 'POST', path: '/guest/revoke' },
 };
-const localized = new Set(['home', 'page', 'content', 'contentById', 'events']);
+const localized = new Set(['home', 'page', 'content', 'contentById', 'search', 'events']);
 function uuid() {
     if (globalThis.crypto?.randomUUID)
         return globalThis.crypto.randomUUID();
@@ -72,7 +82,8 @@ export function createClient(options) {
             memory.delete(url); },
     } : options.cache;
     const defaultHeaders = new Headers(options.headers);
-    async function request(name, opts = {}, query = {}, param, payload, key) {
+    // private: credentials in `headers`, never cached; text: a non-JSON body (calendar files)
+    async function request(name, opts = {}, query = {}, param, payload, key, extra = {}) {
         const endpoint = endpoints[name];
         const path = endpoint.path.replace(/\{\w+\}/, () => {
             if (!param || param.split('/').some(p => p === '.' || p === '..'))
@@ -94,7 +105,11 @@ export function createClient(options) {
             opts.signal?.addEventListener('abort', abort, { once: true });
         const timer = setTimeout(() => controller.abort(new AcmsError(0, 'timeout', 'Request timed out.', undefined, undefined, key)), timeoutMs);
         const signal = controller.signal;
-        const cacheable = endpoint.method === 'GET' && name !== 'availability' && cache;
+        const cacheable = endpoint.method === 'GET' && name !== 'availability' && !extra.headers && cache;
+        // only replay what the server treats as repeatable: a lost reply to a code
+        // exchange or a move must not run it twice
+        const replayable = endpoint.method !== 'POST' || !!key || name === 'registerDevice';
+        const deadline = Date.now() + timeoutMs;
         try {
             if (signal.aborted)
                 throw signal.reason;
@@ -107,6 +122,10 @@ export function createClient(options) {
                 headers.set('If-None-Match', cached.etag);
             if (key)
                 headers.set('Idempotency-Key', key);
+            for (const [k, v] of Object.entries(extra.headers ?? {}))
+                headers.set(k, v);
+            if (extra.text)
+                headers.set('Accept', 'text/calendar');
             if (payload !== undefined)
                 headers.set('Content-Type', 'application/json');
             const body = payload !== undefined ? JSON.stringify(payload) : undefined;
@@ -118,22 +137,26 @@ export function createClient(options) {
                 catch (error) {
                     if (signal.aborted)
                         throw signal.reason;
-                    if (attempt < 2) {
+                    if (replayable && attempt < 2) {
                         await pause(250 * 2 ** attempt, signal);
                         continue;
                     }
                     throw new AcmsError(0, 'network_error', error instanceof Error ? error.message : 'Network request failed.', undefined, undefined, key);
                 }
                 const retryAfter = retrySeconds(res.headers.get('Retry-After'));
-                if ((res.status === 429 || res.status >= 500) && attempt < 2) {
+                const wait = Math.max(250 * 2 ** attempt, (retryAfter ?? 0) * 1000);
+                // a wait that would outlast the timeout returns the 429/5xx (with retryAfter) instead
+                if ((res.status === 429 || res.status >= 500) && replayable && attempt < 2 && Date.now() + wait < deadline) {
                     // Release the response stream before retrying.
                     if (res.body)
                         await abortable(res.body.cancel().catch(() => { }), signal);
-                    await pause(Math.max(250 * 2 ** attempt, (retryAfter ?? 0) * 1000), signal);
+                    await pause(wait, signal);
                     continue;
                 }
                 if (res.status === 304 && cached)
                     return cached.body;
+                if (extra.text && res.ok)
+                    return await abortable(res.text(), signal);
                 let json;
                 try {
                     json = await abortable(res.json(), signal);
@@ -143,7 +166,7 @@ export function createClient(options) {
                         throw signal.reason;
                     // fetch can succeed before a network failure interrupts the body stream.
                     if (error instanceof TypeError) {
-                        if (attempt < 2) {
+                        if (replayable && attempt < 2) {
                             await pause(250 * 2 ** attempt, signal);
                             continue;
                         }
@@ -169,6 +192,10 @@ export function createClient(options) {
         }
     }
     const paging = (o) => ({ page: o.page ?? o.cursor, limit: o.limit });
+    const secret = (value, what) => { if (!value || /[\r\n]/.test(value))
+        throw new TypeError(`A ${what} is required.`); return value; };
+    const bookingAuth = (token) => ({ headers: { 'Booking-Token': secret(token, 'booking token') } });
+    const guestAuth = (token) => ({ headers: { Authorization: `Bearer ${secret(token, 'guest token')}` } });
     async function* iterate(load, field, opts) {
         let page = opts.page ?? opts.cursor ?? 1;
         const seen = new Set();
@@ -186,7 +213,7 @@ export function createClient(options) {
         }
         throw new AcmsError(0, 'invalid_response', 'Pagination repeated a page.');
     }
-    const content = (o = {}) => request('content', o, { ...paging(o), kind: o.kind, collection: o.collection });
+    const content = (o = {}) => request('content', o, { ...paging(o), kind: o.kind, collection: o.collection, q: o.q?.trim() || undefined });
     const posts = async (o = {}) => {
         const result = await content({ ...o, kind: 'post' });
         return { ...result, items: result.items.filter(p => !o.tag || p.tags.includes(o.tag)) };
@@ -207,6 +234,13 @@ export function createClient(options) {
         home: (o = {}) => request('home', o),
         page: (slug, o = {}) => request('page', o, {}, slug),
         content, posts, pages, events, resources, paginate,
+        async search(q, o = {}) {
+            const query = q.trim();
+            // blank input (an emptied search box) needs no round trip
+            if (!query)
+                return { locale: o.locale ?? options.locale ?? null, query: '', posts: [], pages: [], events: [], more: { posts: false, pages: false, events: false } };
+            return request('search', o, { q: query, types: o.types?.join(','), collection: o.collection, limit: o.limit });
+        },
         contentById: (id, o = {}) => request('contentById', o, { kind: o.kind }, id),
         async post(slug, o = {}) {
             for await (const item of paginate.posts(o))
@@ -239,6 +273,21 @@ export function createClient(options) {
         updateDevice: (token, input, o = {}) => request('updateDevice', o, {}, token, input),
         unregisterDevice: (token, o = {}) => request('unregisterDevice', o, {}, token),
         pushTopics: (o = {}) => request('pushTopics', o),
+        links: (o = {}) => request('links', o),
+        form: (id, o = {}) => request('form', o, {}, id),
+        submitForm: (id, input, o = {}) => {
+            const { idempotencyKey, ...body } = input;
+            return request('submitForm', o, {}, id, body, idempotencyKey ?? uuid());
+        },
+        manageBooking: (token, o = {}) => request('manageBooking', o, {}, undefined, undefined, undefined, bookingAuth(token)),
+        cancelBooking: (token, o = {}) => request('cancelBooking', o, {}, undefined, undefined, undefined, bookingAuth(token)),
+        rescheduleAvailability: (token, q = {}, o = {}) => request('rescheduleAvailability', o, { from: q.from, days: q.days, minutes: q.minutes }, undefined, undefined, undefined, bookingAuth(token)),
+        rescheduleBooking: (token, input, o = {}) => request('rescheduleBooking', o, {}, undefined, input, undefined, bookingAuth(token)),
+        bookingIcs: (token, o = {}) => request('bookingIcs', o, {}, undefined, undefined, undefined, { ...bookingAuth(token), text: true }),
+        requestGuestCode: (email, o = {}) => request('requestGuestCode', o, {}, undefined, { email }),
+        guestSignIn: (input, o = {}) => request('guestSignIn', o, {}, undefined, input),
+        guestBookings: (guestToken, q = {}, o = {}) => request('guestBookings', o, { when: q.when, page: q.page, limit: q.limit }, undefined, undefined, undefined, guestAuth(guestToken)),
+        guestSignOut: (guestToken, o = {}) => request('guestSignOut', o, {}, undefined, undefined, undefined, guestAuth(guestToken)),
         withLocale: (locale) => createClient({ ...options, locale, cache, headers: defaultHeaders }),
     };
 }