@medalsocial/booking 0.0.0-placeholder.0 → 0.2.0

package/dist/core/portal/vipps-link.d.mts

@@ -0,0 +1,56 @@
+import { BookingConfig } from "../config.mjs";
+import { CookieSource } from "./cookies.mjs";
+//#region src/core/portal/vipps-link.d.ts
+/**
+ * The two short-lived cookies behind «confirm a conflicted Vipps login with
+ * an e-mail code» (SP10 A5).
+ *
+ * BROWSER BINDING. When this site starts a Vipps login it mints 32 random
+ * bytes, keeps them in the binding cookie and sends them to Medal as
+ * `browser_binding`; Medal stores them with the pending link and will only
+ * verify a code from the browser that holds the same value. A `link` copied
+ * out of one browser's address bar is worthless in another's.
+ *
+ * THE LINK. Medal's callback hands the browser an opaque `link` for the
+ * pending login. `/min-side/vipps` — where the callback lands — moves it
+ * straight into the link cookie, scoped to the one route that spends it, and
+ * redirects on without it: the page the parent types the code on never has
+ * the link in its address bar, its history entry, its Referer or any
+ * analytics pageview. The verify route reads it back from the cookie and
+ * sends it to Medal in a POST body — the only place it is ever written.
+ *
+ * Both `httpOnly` (no script reads them), `secure`, `SameSite=Lax` (the Vipps
+ * callback is a top-level navigation from another site, which Lax admits) and
+ * fifteen minutes long — Medal's own lifetime for a pending link.
+ *
+ * THE BINDING IS MANDATORY. Medal binds every pending link to a browser and
+ * refuses a verify without the matching value, so this site does not pretend
+ * otherwise: no binding cookie, no link cookie (the return route), and no
+ * pair to verify (`readVippsLinkPair`). The binding cookie is `__Host-`
+ * prefixed — Secure, `Path=/`, no `Domain` — so no sibling host or insecure
+ * page can plant one. It is new with SP10, so there is no older name to keep
+ * reading.
+ */
+/** The route that spends the link, and so the only path its cookie is sent to. */
+export declare function vippsLinkVerifyPath(config: Pick<BookingConfig, 'paths'>): string;
+export declare function isVippsToken(value: unknown): value is string;
+/** 32 random bytes, unpadded base64url — 43 characters. */
+export declare function mintBrowserBinding(): string;
+export interface VippsLinkCookies {
+  readonly VIPPS_BINDING_COOKIE: string;
+  readonly VIPPS_LINK_COOKIE: string;
+  readonly VIPPS_LINK_VERIFY_PATH: string;
+  writeBrowserBinding(binding: string): Promise<void>;
+  writePendingLink(link: string): Promise<void>;
+  readBrowserBinding(): Promise<string | null>;
+  readVippsLinkPair(): Promise<{
+    link: string;
+    binding: string;
+  } | null>;
+  clearBrowserBinding(): Promise<void>;
+  clearVippsLinkPair(): Promise<void>;
+}
+/** The binding and link cookies, named by `portal.vippsBindingCookieName` / `vippsLinkCookieName`. */
+export declare function createVippsLinkCookies(config: Pick<BookingConfig, 'portal' | 'paths'>, cookies: CookieSource): VippsLinkCookies;
+//#endregion
+//# sourceMappingURL=vipps-link.d.mts.map

package/dist/core/portal/vipps-link.mjs

@@ -0,0 +1,136 @@
+//#region src/core/portal/vipps-link.ts
+/**
+* The two short-lived cookies behind «confirm a conflicted Vipps login with
+* an e-mail code» (SP10 A5).
+*
+* BROWSER BINDING. When this site starts a Vipps login it mints 32 random
+* bytes, keeps them in the binding cookie and sends them to Medal as
+* `browser_binding`; Medal stores them with the pending link and will only
+* verify a code from the browser that holds the same value. A `link` copied
+* out of one browser's address bar is worthless in another's.
+*
+* THE LINK. Medal's callback hands the browser an opaque `link` for the
+* pending login. `/min-side/vipps` — where the callback lands — moves it
+* straight into the link cookie, scoped to the one route that spends it, and
+* redirects on without it: the page the parent types the code on never has
+* the link in its address bar, its history entry, its Referer or any
+* analytics pageview. The verify route reads it back from the cookie and
+* sends it to Medal in a POST body — the only place it is ever written.
+*
+* Both `httpOnly` (no script reads them), `secure`, `SameSite=Lax` (the Vipps
+* callback is a top-level navigation from another site, which Lax admits) and
+* fifteen minutes long — Medal's own lifetime for a pending link.
+*
+* THE BINDING IS MANDATORY. Medal binds every pending link to a browser and
+* refuses a verify without the matching value, so this site does not pretend
+* otherwise: no binding cookie, no link cookie (the return route), and no
+* pair to verify (`readVippsLinkPair`). The binding cookie is `__Host-`
+* prefixed — Secure, `Path=/`, no `Domain` — so no sibling host or insecure
+* page can plant one. It is new with SP10, so there is no older name to keep
+* reading.
+*/
+/** The route that spends the link, and so the only path its cookie is sent to. */
+function vippsLinkVerifyPath(config) {
+	return `${config.paths.portalApi}/vipps/link/verify`;
+}
+const MAX_AGE_SECONDS = 900;
+/** Medal's link and this site's binding are both 32 bytes of unpadded base64url. */
+const TOKEN_SHAPE = /^[A-Za-z0-9_-]{43}$/;
+function isVippsToken(value) {
+	return typeof value === "string" && TOKEN_SHAPE.test(value);
+}
+/** 32 random bytes, unpadded base64url — 43 characters. */
+function mintBrowserBinding() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/** The binding and link cookies, named by `portal.vippsBindingCookieName` / `vippsLinkCookieName`. */
+function createVippsLinkCookies(config, cookies) {
+	const VIPPS_BINDING_COOKIE = config.portal.vippsBindingCookieName;
+	const VIPPS_LINK_COOKIE = config.portal.vippsLinkCookieName;
+	const VIPPS_LINK_VERIFY_PATH = vippsLinkVerifyPath(config);
+	/** The attributes, without a lifetime — a delete must not carry `Max-Age`. */
+	const ATTRIBUTES = {
+		httpOnly: true,
+		secure: true,
+		sameSite: "lax"
+	};
+	const OPTIONS = {
+		...ATTRIBUTES,
+		maxAge: MAX_AGE_SECONDS
+	};
+	async function writeBrowserBinding(binding) {
+		(await cookies()).set(VIPPS_BINDING_COOKIE, binding, {
+			...OPTIONS,
+			path: "/"
+		});
+	}
+	async function writePendingLink(link) {
+		(await cookies()).set(VIPPS_LINK_COOKIE, link, {
+			...OPTIONS,
+			path: VIPPS_LINK_VERIFY_PATH
+		});
+	}
+	/** This browser's binding, when it holds one of the right shape. */
+	async function readBrowserBinding() {
+		const binding = (await cookies()).get(VIPPS_BINDING_COOKIE)?.value;
+		return isVippsToken(binding) ? binding : null;
+	}
+	/**
+	* What the verify route needs: the link AND the binding, both the right
+	* shape — or `null`, which the route answers without asking Medal.
+	*/
+	async function readVippsLinkPair() {
+		const jar = await cookies();
+		const link = jar.get(VIPPS_LINK_COOKIE)?.value;
+		const binding = jar.get(VIPPS_BINDING_COOKIE)?.value;
+		if (!isVippsToken(link) || !isVippsToken(binding)) return null;
+		return {
+			link,
+			binding
+		};
+	}
+	/**
+	* The binding alone gone — a login that ended without a pending link (a
+	* grant, a start that failed). Deleted with the attributes it was set with:
+	* a `__Host-` cookie is only replaced by a Secure `Path=/` one.
+	*/
+	async function clearBrowserBinding() {
+		(await cookies()).delete({
+			name: VIPPS_BINDING_COOKIE,
+			...ATTRIBUTES,
+			path: "/"
+		});
+	}
+	/** Both gone, once the link has been spent: neither is worth anything after. */
+	async function clearVippsLinkPair() {
+		const jar = await cookies();
+		jar.delete({
+			name: VIPPS_LINK_COOKIE,
+			...ATTRIBUTES,
+			path: VIPPS_LINK_VERIFY_PATH
+		});
+		jar.delete({
+			name: VIPPS_BINDING_COOKIE,
+			...ATTRIBUTES,
+			path: "/"
+		});
+	}
+	return {
+		VIPPS_BINDING_COOKIE,
+		VIPPS_LINK_COOKIE,
+		VIPPS_LINK_VERIFY_PATH,
+		writeBrowserBinding,
+		writePendingLink,
+		readBrowserBinding,
+		readVippsLinkPair,
+		clearBrowserBinding,
+		clearVippsLinkPair
+	};
+}
+//#endregion
+export { createVippsLinkCookies, isVippsToken, mintBrowserBinding, vippsLinkVerifyPath };
+
+//# sourceMappingURL=vipps-link.mjs.map

package/dist/core/portal/vipps-link.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vipps-link.mjs","names":[],"sources":["../../../src/core/portal/vipps-link.ts"],"sourcesContent":["import type { BookingConfig } from '../config';\nimport type { CookieSource } from './cookies';\n\n/**\n * The two short-lived cookies behind «confirm a conflicted Vipps login with\n * an e-mail code» (SP10 A5).\n *\n * BROWSER BINDING. When this site starts a Vipps login it mints 32 random\n * bytes, keeps them in the binding cookie and sends them to Medal as\n * `browser_binding`; Medal stores them with the pending link and will only\n * verify a code from the browser that holds the same value. A `link` copied\n * out of one browser's address bar is worthless in another's.\n *\n * THE LINK. Medal's callback hands the browser an opaque `link` for the\n * pending login. `/min-side/vipps` — where the callback lands — moves it\n * straight into the link cookie, scoped to the one route that spends it, and\n * redirects on without it: the page the parent types the code on never has\n * the link in its address bar, its history entry, its Referer or any\n * analytics pageview. The verify route reads it back from the cookie and\n * sends it to Medal in a POST body — the only place it is ever written.\n *\n * Both `httpOnly` (no script reads them), `secure`, `SameSite=Lax` (the Vipps\n * callback is a top-level navigation from another site, which Lax admits) and\n * fifteen minutes long — Medal's own lifetime for a pending link.\n *\n * THE BINDING IS MANDATORY. Medal binds every pending link to a browser and\n * refuses a verify without the matching value, so this site does not pretend\n * otherwise: no binding cookie, no link cookie (the return route), and no\n * pair to verify (`readVippsLinkPair`). The binding cookie is `__Host-`\n * prefixed — Secure, `Path=/`, no `Domain` — so no sibling host or insecure\n * page can plant one. It is new with SP10, so there is no older name to keep\n * reading.\n */\n\n/** The route that spends the link, and so the only path its cookie is sent to. */\nexport function vippsLinkVerifyPath(config: Pick<BookingConfig, 'paths'>): string {\n  return `${config.paths.portalApi}/vipps/link/verify`;\n}\n\nconst MAX_AGE_SECONDS = 15 * 60;\n\n/** Medal's link and this site's binding are both 32 bytes of unpadded base64url. */\nconst TOKEN_SHAPE = /^[A-Za-z0-9_-]{43}$/;\n\nexport function isVippsToken(value: unknown): value is string {\n  return typeof value === 'string' && TOKEN_SHAPE.test(value);\n}\n\n/** 32 random bytes, unpadded base64url — 43 characters. */\nexport function mintBrowserBinding(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = '';\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');\n}\n\nexport interface VippsLinkCookies {\n  readonly VIPPS_BINDING_COOKIE: string;\n  readonly VIPPS_LINK_COOKIE: string;\n  readonly VIPPS_LINK_VERIFY_PATH: string;\n  writeBrowserBinding(binding: string): Promise<void>;\n  writePendingLink(link: string): Promise<void>;\n  readBrowserBinding(): Promise<string | null>;\n  readVippsLinkPair(): Promise<{ link: string; binding: string } | null>;\n  clearBrowserBinding(): Promise<void>;\n  clearVippsLinkPair(): Promise<void>;\n}\n\n/** The binding and link cookies, named by `portal.vippsBindingCookieName` / `vippsLinkCookieName`. */\nexport function createVippsLinkCookies(\n  config: Pick<BookingConfig, 'portal' | 'paths'>,\n  cookies: CookieSource\n): VippsLinkCookies {\n  const VIPPS_BINDING_COOKIE = config.portal.vippsBindingCookieName;\n  const VIPPS_LINK_COOKIE = config.portal.vippsLinkCookieName;\n  const VIPPS_LINK_VERIFY_PATH = vippsLinkVerifyPath(config);\n\n  /** The attributes, without a lifetime — a delete must not carry `Max-Age`. */\n  const ATTRIBUTES = { httpOnly: true, secure: true, sameSite: 'lax' as const };\n  const OPTIONS = { ...ATTRIBUTES, maxAge: MAX_AGE_SECONDS };\n\n  async function writeBrowserBinding(binding: string): Promise<void> {\n    (await cookies()).set(VIPPS_BINDING_COOKIE, binding, { ...OPTIONS, path: '/' });\n  }\n\n  async function writePendingLink(link: string): Promise<void> {\n    (await cookies()).set(VIPPS_LINK_COOKIE, link, { ...OPTIONS, path: VIPPS_LINK_VERIFY_PATH });\n  }\n\n  /** This browser's binding, when it holds one of the right shape. */\n  async function readBrowserBinding(): Promise<string | null> {\n    const binding = (await cookies()).get(VIPPS_BINDING_COOKIE)?.value;\n    return isVippsToken(binding) ? binding : null;\n  }\n\n  /**\n   * What the verify route needs: the link AND the binding, both the right\n   * shape — or `null`, which the route answers without asking Medal.\n   */\n  async function readVippsLinkPair(): Promise<{ link: string; binding: string } | null> {\n    const jar = await cookies();\n    const link = jar.get(VIPPS_LINK_COOKIE)?.value;\n    const binding = jar.get(VIPPS_BINDING_COOKIE)?.value;\n    if (!isVippsToken(link) || !isVippsToken(binding)) return null;\n    return { link, binding };\n  }\n\n  /**\n   * The binding alone gone — a login that ended without a pending link (a\n   * grant, a start that failed). Deleted with the attributes it was set with:\n   * a `__Host-` cookie is only replaced by a Secure `Path=/` one.\n   */\n  async function clearBrowserBinding(): Promise<void> {\n    (await cookies()).delete({ name: VIPPS_BINDING_COOKIE, ...ATTRIBUTES, path: '/' });\n  }\n\n  /** Both gone, once the link has been spent: neither is worth anything after. */\n  async function clearVippsLinkPair(): Promise<void> {\n    const jar = await cookies();\n    jar.delete({ name: VIPPS_LINK_COOKIE, ...ATTRIBUTES, path: VIPPS_LINK_VERIFY_PATH });\n    jar.delete({ name: VIPPS_BINDING_COOKIE, ...ATTRIBUTES, path: '/' });\n  }\n\n  return {\n    VIPPS_BINDING_COOKIE,\n    VIPPS_LINK_COOKIE,\n    VIPPS_LINK_VERIFY_PATH,\n    writeBrowserBinding,\n    writePendingLink,\n    readBrowserBinding,\n    readVippsLinkPair,\n    clearBrowserBinding,\n    clearVippsLinkPair,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,oBAAoB,QAA8C;CAChF,OAAO,GAAG,OAAO,MAAM,UAAU;AACnC;AAEA,MAAM,kBAAkB;;AAGxB,MAAM,cAAc;AAEpB,SAAgB,aAAa,OAAiC;CAC5D,OAAO,OAAO,UAAU,YAAY,YAAY,KAAK,KAAK;AAC5D;;AAGA,SAAgB,qBAA6B;CAC3C,MAAM,QAAQ,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;CACvD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AACjF;;AAeA,SAAgB,uBACd,QACA,SACkB;CAClB,MAAM,uBAAuB,OAAO,OAAO;CAC3C,MAAM,oBAAoB,OAAO,OAAO;CACxC,MAAM,yBAAyB,oBAAoB,MAAM;;CAGzD,MAAM,aAAa;EAAE,UAAU;EAAM,QAAQ;EAAM,UAAU;CAAe;CAC5E,MAAM,UAAU;EAAE,GAAG;EAAY,QAAQ;CAAgB;CAEzD,eAAe,oBAAoB,SAAgC;EACjE,CAAC,MAAM,QAAQ,EAAA,CAAG,IAAI,sBAAsB,SAAS;GAAE,GAAG;GAAS,MAAM;EAAI,CAAC;CAChF;CAEA,eAAe,iBAAiB,MAA6B;EAC3D,CAAC,MAAM,QAAQ,EAAA,CAAG,IAAI,mBAAmB,MAAM;GAAE,GAAG;GAAS,MAAM;EAAuB,CAAC;CAC7F;;CAGA,eAAe,qBAA6C;EAC1D,MAAM,WAAW,MAAM,QAAQ,EAAA,CAAG,IAAI,oBAAoB,CAAC,EAAE;EAC7D,OAAO,aAAa,OAAO,IAAI,UAAU;CAC3C;;;;;CAMA,eAAe,oBAAuE;EACpF,MAAM,MAAM,MAAM,QAAQ;EAC1B,MAAM,OAAO,IAAI,IAAI,iBAAiB,CAAC,EAAE;EACzC,MAAM,UAAU,IAAI,IAAI,oBAAoB,CAAC,EAAE;EAC/C,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,OAAO,GAAG,OAAO;EAC1D,OAAO;GAAE;GAAM;EAAQ;CACzB;;;;;;CAOA,eAAe,sBAAqC;EAClD,CAAC,MAAM,QAAQ,EAAA,CAAG,OAAO;GAAE,MAAM;GAAsB,GAAG;GAAY,MAAM;EAAI,CAAC;CACnF;;CAGA,eAAe,qBAAoC;EACjD,MAAM,MAAM,MAAM,QAAQ;EAC1B,IAAI,OAAO;GAAE,MAAM;GAAmB,GAAG;GAAY,MAAM;EAAuB,CAAC;EACnF,IAAI,OAAO;GAAE,MAAM;GAAsB,GAAG;GAAY,MAAM;EAAI,CAAC;CACrE;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/core/portal/vipps-return.d.mts

@@ -0,0 +1,39 @@
+//#region src/core/portal/vipps-return.d.ts
+/**
+ * The «confirm with a code» return from Vipps (SP10), as the pages that
+ * receive it read it — free of `server-only`, because both readers are in the
+ * browser (the Min side login and the booking wizard).
+ *
+ * `/min-side/vipps` sends the parent on with `?vipps=confirm_email` and, when
+ * Medal named one, `&to=<masked address>` — the address the code went to, as
+ * `k•••@g•••.com`. The link itself is NOT in this URL: the route moved it into
+ * an httpOnly cookie (`vipps-link.ts`).
+ *
+ * `to` is written by a third party's redirect and is anyone's to edit in an
+ * address bar, so it is RENDERED AS TEXT ONLY and only when it has exactly
+ * the masked shape Medal produces; anything else is the generic sentence.
+ */
+export declare const VIPPS_CONFIRM_QUERY = "confirm_email";
+/** The masked address, or `null` for anything that is not one. */
+export declare function maskedAddress(value: string | null | undefined): string | null;
+/**
+ * Whether the query says «confirm with a code», and to which address.
+ * `undefined` for an ordinary visit; `{ to: null }` when the address is
+ * absent (Medal found the contact by phone) or not the masked shape.
+ */
+export declare function vippsConfirmFrom(query: URLSearchParams | null): {
+  to: string | null;
+} | undefined;
+/**
+ * Take the Vipps return's keys out of the address bar, in place — so the
+ * masked address, and anything else a callback left there, is not in the
+ * history entry, a bookmark, a shared link or a later pageview. The
+ * `?vipps=confirm_email` marker goes too: the page has read it, and a reload
+ * must not reopen a code step for a link that may be spent.
+ *
+ * Other keys stay (`resume`, a deep link's `kategori`…). No-op when there is
+ * nothing to take.
+ */
+export declare function stripVippsReturn(): void;
+//#endregion
+//# sourceMappingURL=vipps-return.d.mts.map

package/dist/core/portal/vipps-return.mjs

@@ -0,0 +1,69 @@
+//#region src/core/portal/vipps-return.ts
+/**
+* The «confirm with a code» return from Vipps (SP10), as the pages that
+* receive it read it — free of `server-only`, because both readers are in the
+* browser (the Min side login and the booking wizard).
+*
+* `/min-side/vipps` sends the parent on with `?vipps=confirm_email` and, when
+* Medal named one, `&to=<masked address>` — the address the code went to, as
+* `k•••@g•••.com`. The link itself is NOT in this URL: the route moved it into
+* an httpOnly cookie (`vipps-link.ts`).
+*
+* `to` is written by a third party's redirect and is anyone's to edit in an
+* address bar, so it is RENDERED AS TEXT ONLY and only when it has exactly
+* the masked shape Medal produces; anything else is the generic sentence.
+*/
+const VIPPS_CONFIRM_QUERY = "confirm_email";
+/** One visible character, the mask, `@`, one character, the mask, a TLD. */
+const MASKED_ADDRESS = /^[^\s<>@]•••@[^\s<>@.]•••\.[A-Za-z]{2,24}$/;
+/** The masked address, or `null` for anything that is not one. */
+function maskedAddress(value) {
+	return typeof value === "string" && MASKED_ADDRESS.test(value) ? value : null;
+}
+/**
+* Whether the query says «confirm with a code», and to which address.
+* `undefined` for an ordinary visit; `{ to: null }` when the address is
+* absent (Medal found the contact by phone) or not the masked shape.
+*/
+function vippsConfirmFrom(query) {
+	const values = query?.getAll("vipps") ?? [];
+	if (values.length !== 1 || values[0] !== "confirm_email") return void 0;
+	/* v8 ignore next -- `query` is non-null once a `vipps` value was read off it */
+	const to = query?.getAll("to") ?? [];
+	return { to: to.length === 1 ? maskedAddress(to[0]) : null };
+}
+/** The keys a Vipps return can leave in an address bar. */
+const VIPPS_KEYS = [
+	"link",
+	"to",
+	"grant"
+];
+/**
+* Take the Vipps return's keys out of the address bar, in place — so the
+* masked address, and anything else a callback left there, is not in the
+* history entry, a bookmark, a shared link or a later pageview. The
+* `?vipps=confirm_email` marker goes too: the page has read it, and a reload
+* must not reopen a code step for a link that may be spent.
+*
+* Other keys stay (`resume`, a deep link's `kategori`…). No-op when there is
+* nothing to take.
+*/
+function stripVippsReturn() {
+	if (typeof window === "undefined") return;
+	const url = new URL(window.location.href);
+	let changed = false;
+	for (const key of VIPPS_KEYS) if (url.searchParams.has(key)) {
+		url.searchParams.delete(key);
+		changed = true;
+	}
+	if (url.searchParams.get("vipps") === "confirm_email") {
+		url.searchParams.delete("vipps");
+		changed = true;
+	}
+	if (!changed) return;
+	window.history.replaceState(window.history.state, "", `${url.pathname}${url.search}${url.hash}`);
+}
+//#endregion
+export { VIPPS_CONFIRM_QUERY, maskedAddress, stripVippsReturn, vippsConfirmFrom };
+
+//# sourceMappingURL=vipps-return.mjs.map

package/dist/core/portal/vipps-return.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vipps-return.mjs","names":[],"sources":["../../../src/core/portal/vipps-return.ts"],"sourcesContent":["/**\n * The «confirm with a code» return from Vipps (SP10), as the pages that\n * receive it read it — free of `server-only`, because both readers are in the\n * browser (the Min side login and the booking wizard).\n *\n * `/min-side/vipps` sends the parent on with `?vipps=confirm_email` and, when\n * Medal named one, `&to=<masked address>` — the address the code went to, as\n * `k•••@g•••.com`. The link itself is NOT in this URL: the route moved it into\n * an httpOnly cookie (`vipps-link.ts`).\n *\n * `to` is written by a third party's redirect and is anyone's to edit in an\n * address bar, so it is RENDERED AS TEXT ONLY and only when it has exactly\n * the masked shape Medal produces; anything else is the generic sentence.\n */\n\nexport const VIPPS_CONFIRM_QUERY = 'confirm_email';\n\n/** One visible character, the mask, `@`, one character, the mask, a TLD. */\nconst MASKED_ADDRESS = /^[^\\s<>@]•••@[^\\s<>@.]•••\\.[A-Za-z]{2,24}$/;\n\n/** The masked address, or `null` for anything that is not one. */\nexport function maskedAddress(value: string | null | undefined): string | null {\n  return typeof value === 'string' && MASKED_ADDRESS.test(value) ? value : null;\n}\n\n/**\n * Whether the query says «confirm with a code», and to which address.\n * `undefined` for an ordinary visit; `{ to: null }` when the address is\n * absent (Medal found the contact by phone) or not the masked shape.\n */\nexport function vippsConfirmFrom(query: URLSearchParams | null): { to: string | null } | undefined {\n  const values = query?.getAll('vipps') ?? [];\n  if (values.length !== 1 || values[0] !== VIPPS_CONFIRM_QUERY) return undefined;\n  /* v8 ignore next -- `query` is non-null once a `vipps` value was read off it */\n  const to = query?.getAll('to') ?? [];\n  return { to: to.length === 1 ? maskedAddress(to[0]) : null };\n}\n\n/** The keys a Vipps return can leave in an address bar. */\nconst VIPPS_KEYS = ['link', 'to', 'grant'] as const;\n\n/**\n * Take the Vipps return's keys out of the address bar, in place — so the\n * masked address, and anything else a callback left there, is not in the\n * history entry, a bookmark, a shared link or a later pageview. The\n * `?vipps=confirm_email` marker goes too: the page has read it, and a reload\n * must not reopen a code step for a link that may be spent.\n *\n * Other keys stay (`resume`, a deep link's `kategori`…). No-op when there is\n * nothing to take.\n */\nexport function stripVippsReturn(): void {\n  if (typeof window === 'undefined') return;\n  const url = new URL(window.location.href);\n  let changed = false;\n  for (const key of VIPPS_KEYS) {\n    if (url.searchParams.has(key)) {\n      url.searchParams.delete(key);\n      changed = true;\n    }\n  }\n  if (url.searchParams.get('vipps') === VIPPS_CONFIRM_QUERY) {\n    url.searchParams.delete('vipps');\n    changed = true;\n  }\n  if (!changed) return;\n  window.history.replaceState(window.history.state, '', `${url.pathname}${url.search}${url.hash}`);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAeA,MAAa,sBAAsB;;AAGnC,MAAM,iBAAiB;;AAGvB,SAAgB,cAAc,OAAiD;CAC7E,OAAO,OAAO,UAAU,YAAY,eAAe,KAAK,KAAK,IAAI,QAAQ;AAC3E;;;;;;AAOA,SAAgB,iBAAiB,OAAkE;CACjG,MAAM,SAAS,OAAO,OAAO,OAAO,KAAK,CAAC;CAC1C,IAAI,OAAO,WAAW,KAAK,OAAO,OAAA,iBAA4B,OAAO,KAAA;;CAErE,MAAM,KAAK,OAAO,OAAO,IAAI,KAAK,CAAC;CACnC,OAAO,EAAE,IAAI,GAAG,WAAW,IAAI,cAAc,GAAG,EAAE,IAAI,KAAK;AAC7D;;AAGA,MAAM,aAAa;CAAC;CAAQ;CAAM;AAAO;;;;;;;;;;;AAYzC,SAAgB,mBAAyB;CACvC,IAAI,OAAO,WAAW,aAAa;CACnC,MAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;CACxC,IAAI,UAAU;CACd,KAAK,MAAM,OAAO,YAChB,IAAI,IAAI,aAAa,IAAI,GAAG,GAAG;EAC7B,IAAI,aAAa,OAAO,GAAG;EAC3B,UAAU;CACZ;CAEF,IAAI,IAAI,aAAa,IAAI,OAAO,MAAA,iBAA2B;EACzD,IAAI,aAAa,OAAO,OAAO;EAC/B,UAAU;CACZ;CACA,IAAI,CAAC,SAAS;CACd,OAAO,QAAQ,aAAa,OAAO,QAAQ,OAAO,IAAI,GAAG,IAAI,WAAW,IAAI,SAAS,IAAI,MAAM;AACjG"}

package/dist/core/rebook-store.d.mts

@@ -0,0 +1,28 @@
+//#region src/core/rebook-store.d.ts
+/**
+ * The child's name a «Bestill igjen» card hands the wizard — carried in the
+ * tab's `sessionStorage`, never in the URL.
+ *
+ * The service and stylist ids ride in the query string because they are
+ * catalogue ids and a parent may as well see them; a child's name is personal
+ * data about a minor, and a query string is copied into browser history, the
+ * edge access log and every analytics pageview that records `location`.
+ * `sessionStorage` is none of those: one tab, gone with it, read once.
+ *
+ * Read-once (`take`) so a name stashed for one rebook cannot resurface on a
+ * later, unrelated visit to `/bestill` in the same tab.
+ *
+ * Every path falls back to «nothing stashed» rather than throwing — no
+ * storage during the server render, Safari private mode, storage turned off —
+ * because the worst case is a parent typing a name they have typed before.
+ */
+/** `<namespace>:booking:rebook-who`. */
+export declare function rebookStorageKey(namespace: string): string;
+export interface RebookStore {
+  stashRebookWho(name: string | null): void;
+  takeRebookWho(): string | null;
+}
+/** The «book again» name under `<namespace>:booking:rebook-who`. */
+export declare function createRebookStore(namespace: string): RebookStore;
+//#endregion
+//# sourceMappingURL=rebook-store.d.mts.map

package/dist/core/rebook-store.mjs

@@ -0,0 +1,60 @@
+//#region src/core/rebook-store.ts
+/**
+* The child's name a «Bestill igjen» card hands the wizard — carried in the
+* tab's `sessionStorage`, never in the URL.
+*
+* The service and stylist ids ride in the query string because they are
+* catalogue ids and a parent may as well see them; a child's name is personal
+* data about a minor, and a query string is copied into browser history, the
+* edge access log and every analytics pageview that records `location`.
+* `sessionStorage` is none of those: one tab, gone with it, read once.
+*
+* Read-once (`take`) so a name stashed for one rebook cannot resurface on a
+* later, unrelated visit to `/bestill` in the same tab.
+*
+* Every path falls back to «nothing stashed» rather than throwing — no
+* storage during the server render, Safari private mode, storage turned off —
+* because the worst case is a parent typing a name they have typed before.
+*/
+/** `<namespace>:booking:rebook-who`. */
+function rebookStorageKey(namespace) {
+	return `${namespace}:booking:rebook-who`;
+}
+/** The «book again» name under `<namespace>:booking:rebook-who`. */
+function createRebookStore(namespace) {
+	const STORAGE_KEY = rebookStorageKey(namespace);
+	/**
+	* Every tap REPLACES what is stashed — `null` clears it — so a name left
+	* behind by an earlier tap that opened its wizard in another tab (Cmd-click)
+	* cannot be picked up by a later tap for a booking that named nobody, and
+	* prefill the wrong child.
+	*/
+	function stashRebookWho(name) {
+		if (typeof window === "undefined") return;
+		try {
+			if (name === null) {
+				window.sessionStorage.removeItem(STORAGE_KEY);
+				return;
+			}
+			window.sessionStorage.setItem(STORAGE_KEY, name);
+		} catch {}
+	}
+	function takeRebookWho() {
+		if (typeof window === "undefined") return null;
+		try {
+			const name = window.sessionStorage.getItem(STORAGE_KEY);
+			window.sessionStorage.removeItem(STORAGE_KEY);
+			return name !== null && name.trim().length > 0 ? name : null;
+		} catch {
+			return null;
+		}
+	}
+	return {
+		stashRebookWho,
+		takeRebookWho
+	};
+}
+//#endregion
+export { createRebookStore, rebookStorageKey };
+
+//# sourceMappingURL=rebook-store.mjs.map

package/dist/core/rebook-store.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebook-store.mjs","names":[],"sources":["../../src/core/rebook-store.ts"],"sourcesContent":["/**\n * The child's name a «Bestill igjen» card hands the wizard — carried in the\n * tab's `sessionStorage`, never in the URL.\n *\n * The service and stylist ids ride in the query string because they are\n * catalogue ids and a parent may as well see them; a child's name is personal\n * data about a minor, and a query string is copied into browser history, the\n * edge access log and every analytics pageview that records `location`.\n * `sessionStorage` is none of those: one tab, gone with it, read once.\n *\n * Read-once (`take`) so a name stashed for one rebook cannot resurface on a\n * later, unrelated visit to `/bestill` in the same tab.\n *\n * Every path falls back to «nothing stashed» rather than throwing — no\n * storage during the server render, Safari private mode, storage turned off —\n * because the worst case is a parent typing a name they have typed before.\n */\n/** `<namespace>:booking:rebook-who`. */\nexport function rebookStorageKey(namespace: string): string {\n  return `${namespace}:booking:rebook-who`;\n}\n\nexport interface RebookStore {\n  stashRebookWho(name: string | null): void;\n  takeRebookWho(): string | null;\n}\n\n/** The «book again» name under `<namespace>:booking:rebook-who`. */\nexport function createRebookStore(namespace: string): RebookStore {\n  const STORAGE_KEY = rebookStorageKey(namespace);\n\n  /**\n   * Every tap REPLACES what is stashed — `null` clears it — so a name left\n   * behind by an earlier tap that opened its wizard in another tab (Cmd-click)\n   * cannot be picked up by a later tap for a booking that named nobody, and\n   * prefill the wrong child.\n   */\n  function stashRebookWho(name: string | null): void {\n    if (typeof window === 'undefined') return;\n    try {\n      if (name === null) {\n        window.sessionStorage.removeItem(STORAGE_KEY);\n        return;\n      }\n      window.sessionStorage.setItem(STORAGE_KEY, name);\n    } catch {\n      // The wizard simply asks for the name.\n    }\n  }\n\n  function takeRebookWho(): string | null {\n    if (typeof window === 'undefined') return null;\n    try {\n      const name = window.sessionStorage.getItem(STORAGE_KEY);\n      window.sessionStorage.removeItem(STORAGE_KEY);\n      return name !== null && name.trim().length > 0 ? name : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return { stashRebookWho, takeRebookWho };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkBA,SAAgB,iBAAiB,WAA2B;CAC1D,OAAO,GAAG,UAAU;AACtB;;AAQA,SAAgB,kBAAkB,WAAgC;CAChE,MAAM,cAAc,iBAAiB,SAAS;;;;;;;CAQ9C,SAAS,eAAe,MAA2B;EACjD,IAAI,OAAO,WAAW,aAAa;EACnC,IAAI;GACF,IAAI,SAAS,MAAM;IACjB,OAAO,eAAe,WAAW,WAAW;IAC5C;GACF;GACA,OAAO,eAAe,QAAQ,aAAa,IAAI;EACjD,QAAQ,CAER;CACF;CAEA,SAAS,gBAA+B;EACtC,IAAI,OAAO,WAAW,aAAa,OAAO;EAC1C,IAAI;GACF,MAAM,OAAO,OAAO,eAAe,QAAQ,WAAW;GACtD,OAAO,eAAe,WAAW,WAAW;GAC5C,OAAO,SAAS,QAAQ,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,OAAO;EAC1D,QAAQ;GACN,OAAO;EACT;CACF;CAEA,OAAO;EAAE;EAAgB;CAAc;AACzC"}

package/dist/core/restore-gate.d.mts

@@ -0,0 +1,40 @@
+//#region src/core/restore-gate.d.ts
+/**
+ * Whether this tab's storage holds something the booking wizard's mount effect
+ * will restore — a confirmation, a submission still owed an answer, or (behind
+ * `?resume=1`) a Vipps draft — read WITHOUT consuming or minting anything.
+ *
+ * It mirrors the mount effect's own order and rules (the attempt TTL, the
+ * draft's 30-minute window and its future-stamp refusal, a link — «Bestill
+ * igjen» or any deep-link parameter, which is what `prefilled` means —
+ * outranking a stored confirmation) so the gate is up exactly when the
+ * screen is about to change.
+ *
+ * SELF-CONTAINED ON PURPOSE: its source is inlined as a script by
+ * `restoreGateScript`, so it may reference nothing but its arguments and
+ * browser globals. Only the storage reads are guarded; anything else that
+ * throws (a stray module reference) surfaces in the tests instead of
+ * silently reading as «nothing to restore».
+ */
+export declare function restorePendingInStorage(attemptKey: string, attemptTtlMs: number, draftKey: string, draftMaxAgeMs: number, prefilled: boolean, resuming: boolean): boolean;
+/**
+ * The same check, as the script the SERVER's HTML carries.
+ *
+ * The server cannot see this tab's storage, so it always renders step 1 — and
+ * hydration must match it. This runs while the HTML is parsed, before first
+ * paint, and marks the wizard root `data-restoring` when there is something to
+ * restore; CSS then hides step 1 behind the skeleton until React takes over.
+ * If React never takes over, a timer lifts the mark after
+ * `RESTORE_FALLBACK_MS`. The expression evaluates to the check's answer, which is what lets a test
+ * tell «nothing to restore» from «the script broke».
+ */
+/** How long the pre-hydration gate may hide step 1 before it gives up. */
+export declare const RESTORE_FALLBACK_MS = 10000;
+export interface RestoreGate {
+  restorePendingInStorage: typeof restorePendingInStorage;
+  restoreGateScript(rootId: string, prefilled: boolean, resuming: boolean): string;
+}
+/** The gate for the stores under `namespace` (see `createStores`). */
+export declare function createRestoreGate(namespace: string): RestoreGate;
+//#endregion
+//# sourceMappingURL=restore-gate.d.mts.map

package/dist/core/restore-gate.mjs

@@ -0,0 +1,96 @@
+import { ATTEMPT_TTL_MS, attemptStorageKey } from "./attempt-store.mjs";
+import { DRAFT_MAX_AGE_MS, draftStorageKey } from "./draft-store.mjs";
+//#region src/core/restore-gate.ts
+/**
+* Whether this tab's storage holds something the booking wizard's mount effect
+* will restore — a confirmation, a submission still owed an answer, or (behind
+* `?resume=1`) a Vipps draft — read WITHOUT consuming or minting anything.
+*
+* It mirrors the mount effect's own order and rules (the attempt TTL, the
+* draft's 30-minute window and its future-stamp refusal, a link — «Bestill
+* igjen» or any deep-link parameter, which is what `prefilled` means —
+* outranking a stored confirmation) so the gate is up exactly when the
+* screen is about to change.
+*
+* SELF-CONTAINED ON PURPOSE: its source is inlined as a script by
+* `restoreGateScript`, so it may reference nothing but its arguments and
+* browser globals. Only the storage reads are guarded; anything else that
+* throws (a stray module reference) surfaces in the tests instead of
+* silently reading as «nothing to restore».
+*/
+function restorePendingInStorage(attemptKey, attemptTtlMs, draftKey, draftMaxAgeMs, prefilled, resuming) {
+	const read = (key) => {
+		try {
+			const value = JSON.parse(window.sessionStorage.getItem(key) || "null");
+			return value !== null && typeof value === "object" ? value : null;
+		} catch {
+			return null;
+		}
+	};
+	const now = Date.now();
+	const attempt = read(attemptKey);
+	const live = attempt !== null && typeof attempt.nonce === "string" && typeof attempt.at === "number" && now - attempt.at <= attemptTtlMs;
+	if (live && attempt.pending !== void 0) return true;
+	if (live && attempt.confirmed !== void 0 && !prefilled) return true;
+	if (!resuming) return false;
+	const draft = read(draftKey);
+	if (draft === null || typeof draft.savedAt !== "number") return false;
+	const age = now - draft.savedAt;
+	return age >= 0 && age <= draftMaxAgeMs && Array.isArray(draft.items) && draft.items.length > 0;
+}
+/**
+* The same check, as the script the SERVER's HTML carries.
+*
+* The server cannot see this tab's storage, so it always renders step 1 — and
+* hydration must match it. This runs while the HTML is parsed, before first
+* paint, and marks the wizard root `data-restoring` when there is something to
+* restore; CSS then hides step 1 behind the skeleton until React takes over.
+* If React never takes over, a timer lifts the mark after
+* `RESTORE_FALLBACK_MS`. The expression evaluates to the check's answer, which is what lets a test
+* tell «nothing to restore» from «the script broke».
+*/
+/** How long the pre-hydration gate may hide step 1 before it gives up. */
+const RESTORE_FALLBACK_MS = 1e4;
+/** The characters that can end or bend an inline `<script>` from inside a string literal. */
+const SCRIPT_UNSAFE = {
+	"<": "\\u003C",
+	">": "\\u003E",
+	"/": "\\u002F",
+	"\u2028": "\\u2028",
+	"\u2029": "\\u2029"
+};
+/**
+* A value as a JavaScript literal that is safe INSIDE an HTML `<script>`.
+*
+* `JSON.stringify` alone is a valid literal but not a safe one: a root id
+* holding `<\/script>` would end the element mid-string, and U+2028/U+2029 end
+* a line in older parsers. Escaping them as `\uXXXX` keeps the value exactly
+* the same once the script runs — the storage keys and ids this site passes
+* contain none of them, so the emitted script is unchanged for them.
+*/
+function scriptLiteral(value) {
+	return JSON.stringify(value).replace(/[<>/\u2028\u2029]/g, (char) => SCRIPT_UNSAFE[char]);
+}
+function restoreGateScript(namespace, rootId, prefilled, resuming) {
+	const args = [
+		attemptStorageKey(namespace),
+		ATTEMPT_TTL_MS,
+		draftStorageKey(namespace),
+		DRAFT_MAX_AGE_MS,
+		prefilled,
+		resuming
+	].map(scriptLiteral);
+	const id = scriptLiteral(rootId);
+	return `(function(){var on=(${restorePendingInStorage.toString()})(${args.join(",")});if(on){var r=document.getElementById(${id});if(r){r.setAttribute('data-restoring','');setTimeout(function(){var n=document.getElementById(${id});if(n&&!n.hasAttribute('data-hydrated'))n.removeAttribute('data-restoring')},${RESTORE_FALLBACK_MS})}}return on})()`;
+}
+/** The gate for the stores under `namespace` (see `createStores`). */
+function createRestoreGate(namespace) {
+	return {
+		restorePendingInStorage,
+		restoreGateScript: (rootId, prefilled, resuming) => restoreGateScript(namespace, rootId, prefilled, resuming)
+	};
+}
+//#endregion
+export { RESTORE_FALLBACK_MS, createRestoreGate, restorePendingInStorage };
+
+//# sourceMappingURL=restore-gate.mjs.map

package/dist/core/restore-gate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore-gate.mjs","names":[],"sources":["../../src/core/restore-gate.ts"],"sourcesContent":["import { ATTEMPT_TTL_MS, attemptStorageKey } from './attempt-store';\nimport { DRAFT_MAX_AGE_MS, draftStorageKey } from './draft-store';\n\n/**\n * Whether this tab's storage holds something the booking wizard's mount effect\n * will restore — a confirmation, a submission still owed an answer, or (behind\n * `?resume=1`) a Vipps draft — read WITHOUT consuming or minting anything.\n *\n * It mirrors the mount effect's own order and rules (the attempt TTL, the\n * draft's 30-minute window and its future-stamp refusal, a link — «Bestill\n * igjen» or any deep-link parameter, which is what `prefilled` means —\n * outranking a stored confirmation) so the gate is up exactly when the\n * screen is about to change.\n *\n * SELF-CONTAINED ON PURPOSE: its source is inlined as a script by\n * `restoreGateScript`, so it may reference nothing but its arguments and\n * browser globals. Only the storage reads are guarded; anything else that\n * throws (a stray module reference) surfaces in the tests instead of\n * silently reading as «nothing to restore».\n */\nexport function restorePendingInStorage(\n  attemptKey: string,\n  attemptTtlMs: number,\n  draftKey: string,\n  draftMaxAgeMs: number,\n  prefilled: boolean,\n  resuming: boolean\n): boolean {\n  const read = (key: string): Record<string, unknown> | null => {\n    try {\n      const value = JSON.parse(window.sessionStorage.getItem(key) || 'null');\n      return value !== null && typeof value === 'object' ? value : null;\n    } catch {\n      return null;\n    }\n  };\n  const now = Date.now();\n  const attempt = read(attemptKey);\n  const live =\n    attempt !== null &&\n    typeof attempt.nonce === 'string' &&\n    typeof attempt.at === 'number' &&\n    now - attempt.at <= attemptTtlMs;\n  if (live && attempt.pending !== undefined) return true;\n  // A link outranks a stored confirmation — the mount effect forgets it and\n  // carries on — so only an unlinked visit is about to show one.\n  if (live && attempt.confirmed !== undefined && !prefilled) return true;\n  if (!resuming) return false;\n  const draft = read(draftKey);\n  if (draft === null || typeof draft.savedAt !== 'number') return false;\n  const age = now - draft.savedAt;\n  return age >= 0 && age <= draftMaxAgeMs && Array.isArray(draft.items) && draft.items.length > 0;\n}\n\n/**\n * The same check, as the script the SERVER's HTML carries.\n *\n * The server cannot see this tab's storage, so it always renders step 1 — and\n * hydration must match it. This runs while the HTML is parsed, before first\n * paint, and marks the wizard root `data-restoring` when there is something to\n * restore; CSS then hides step 1 behind the skeleton until React takes over.\n * If React never takes over, a timer lifts the mark after\n * `RESTORE_FALLBACK_MS`. The expression evaluates to the check's answer, which is what lets a test\n * tell «nothing to restore» from «the script broke».\n */\n/** How long the pre-hydration gate may hide step 1 before it gives up. */\nexport const RESTORE_FALLBACK_MS = 10_000;\n\n/** The characters that can end or bend an inline `<script>` from inside a string literal. */\nconst SCRIPT_UNSAFE: Readonly<Record<string, string>> = {\n  '<': '\\\\u003C',\n  '>': '\\\\u003E',\n  '/': '\\\\u002F',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n};\n\n/**\n * A value as a JavaScript literal that is safe INSIDE an HTML `<script>`.\n *\n * `JSON.stringify` alone is a valid literal but not a safe one: a root id\n * holding `</script>` would end the element mid-string, and U+2028/U+2029 end\n * a line in older parsers. Escaping them as `\\uXXXX` keeps the value exactly\n * the same once the script runs — the storage keys and ids this site passes\n * contain none of them, so the emitted script is unchanged for them.\n */\nfunction scriptLiteral(value: unknown): string {\n  return JSON.stringify(value).replace(/[<>/\\u2028\\u2029]/g, (char) => SCRIPT_UNSAFE[char]);\n}\n\nfunction restoreGateScript(\n  namespace: string,\n  rootId: string,\n  prefilled: boolean,\n  resuming: boolean\n): string {\n  const args = [\n    attemptStorageKey(namespace),\n    ATTEMPT_TTL_MS,\n    draftStorageKey(namespace),\n    DRAFT_MAX_AGE_MS,\n    prefilled,\n    resuming,\n  ].map(scriptLiteral);\n  const id = scriptLiteral(rootId);\n  // The fallback: if React has not taken the root over (`data-hydrated`)\n  // within RESTORE_FALLBACK_MS — a script error, a stalled bundle — step 1 is\n  // shown again rather than a skeleton for ever.\n  return `(function(){var on=(${restorePendingInStorage.toString()})(${args.join(',')});if(on){var r=document.getElementById(${id});if(r){r.setAttribute('data-restoring','');setTimeout(function(){var n=document.getElementById(${id});if(n&&!n.hasAttribute('data-hydrated'))n.removeAttribute('data-restoring')},${RESTORE_FALLBACK_MS})}}return on})()`;\n}\n\nexport interface RestoreGate {\n  restorePendingInStorage: typeof restorePendingInStorage;\n  restoreGateScript(rootId: string, prefilled: boolean, resuming: boolean): string;\n}\n\n/** The gate for the stores under `namespace` (see `createStores`). */\nexport function createRestoreGate(namespace: string): RestoreGate {\n  return {\n    restorePendingInStorage,\n    restoreGateScript: (rootId, prefilled, resuming) =>\n      restoreGateScript(namespace, rootId, prefilled, resuming),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,wBACd,YACA,cACA,UACA,eACA,WACA,UACS;CACT,MAAM,QAAQ,QAAgD;EAC5D,IAAI;GACF,MAAM,QAAQ,KAAK,MAAM,OAAO,eAAe,QAAQ,GAAG,KAAK,MAAM;GACrE,OAAO,UAAU,QAAQ,OAAO,UAAU,WAAW,QAAQ;EAC/D,QAAQ;GACN,OAAO;EACT;CACF;CACA,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,UAAU,KAAK,UAAU;CAC/B,MAAM,OACJ,YAAY,QACZ,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,OAAO,YACtB,MAAM,QAAQ,MAAM;CACtB,IAAI,QAAQ,QAAQ,YAAY,KAAA,GAAW,OAAO;CAGlD,IAAI,QAAQ,QAAQ,cAAc,KAAA,KAAa,CAAC,WAAW,OAAO;CAClE,IAAI,CAAC,UAAU,OAAO;CACtB,MAAM,QAAQ,KAAK,QAAQ;CAC3B,IAAI,UAAU,QAAQ,OAAO,MAAM,YAAY,UAAU,OAAO;CAChE,MAAM,MAAM,MAAM,MAAM;CACxB,OAAO,OAAO,KAAK,OAAO,iBAAiB,MAAM,QAAQ,MAAM,KAAK,KAAK,MAAM,MAAM,SAAS;AAChG;;;;;;;;;;;;;AAcA,MAAa,sBAAsB;;AAGnC,MAAM,gBAAkD;CACtD,KAAK;CACL,KAAK;CACL,KAAK;CACL,UAAU;CACV,UAAU;AACZ;;;;;;;;;;AAWA,SAAS,cAAc,OAAwB;CAC7C,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,QAAQ,uBAAuB,SAAS,cAAc,KAAK;AAC1F;AAEA,SAAS,kBACP,WACA,QACA,WACA,UACQ;CACR,MAAM,OAAO;EACX,kBAAkB,SAAS;EAC3B;EACA,gBAAgB,SAAS;EACzB;EACA;EACA;CACF,CAAC,CAAC,IAAI,aAAa;CACnB,MAAM,KAAK,cAAc,MAAM;CAI/B,OAAO,uBAAuB,wBAAwB,SAAS,EAAE,IAAI,KAAK,KAAK,GAAG,EAAE,yCAAyC,GAAG,kGAAkG,GAAG,gFAAgF,oBAAoB;AAC3U;;AAQA,SAAgB,kBAAkB,WAAgC;CAChE,OAAO;EACL;EACA,oBAAoB,QAAQ,WAAW,aACrC,kBAAkB,WAAW,QAAQ,WAAW,QAAQ;CAC5D;AACF"}

package/dist/core/stores.d.mts

@@ -0,0 +1,8 @@
+import { AttemptStore } from "./attempt-store.mjs";
+import { DraftStore } from "./draft-store.mjs";
+import { RebookStore } from "./rebook-store.mjs";
+//#region src/core/stores.d.ts
+export type Stores = DraftStore & AttemptStore & RebookStore;
+export declare function createStores(namespace: string): Stores;
+//#endregion
+//# sourceMappingURL=stores.d.mts.map

package/dist/core/stores.mjs

@@ -0,0 +1,23 @@
+import { createAttemptStore } from "./attempt-store.mjs";
+import { createDraftStore } from "./draft-store.mjs";
+import { createRebookStore } from "./rebook-store.mjs";
+//#region src/core/stores.ts
+/**
+* The three browser stores the wizard keeps, under one namespace.
+*
+* Keys are `<namespace>:booking:draft`, `<namespace>:booking:attempt` and
+* `<namespace>:booking:rebook-who` — so a site moving onto the package keeps
+* every draft and pending attempt a visitor already has, by passing the
+* namespace it used before.
+*/
+function createStores(namespace) {
+	return {
+		...createDraftStore(namespace),
+		...createAttemptStore(namespace),
+		...createRebookStore(namespace)
+	};
+}
+//#endregion
+export { createStores };
+
+//# sourceMappingURL=stores.mjs.map

package/dist/core/stores.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stores.mjs","names":[],"sources":["../../src/core/stores.ts"],"sourcesContent":["/**\n * The three browser stores the wizard keeps, under one namespace.\n *\n * Keys are `<namespace>:booking:draft`, `<namespace>:booking:attempt` and\n * `<namespace>:booking:rebook-who` — so a site moving onto the package keeps\n * every draft and pending attempt a visitor already has, by passing the\n * namespace it used before.\n */\n\nimport { type AttemptStore, createAttemptStore } from './attempt-store';\nimport { createDraftStore, type DraftStore } from './draft-store';\nimport { createRebookStore, type RebookStore } from './rebook-store';\n\nexport type Stores = DraftStore & AttemptStore & RebookStore;\n\nexport function createStores(namespace: string): Stores {\n  return {\n    ...createDraftStore(namespace),\n    ...createAttemptStore(namespace),\n    ...createRebookStore(namespace),\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAeA,SAAgB,aAAa,WAA2B;CACtD,OAAO;EACL,GAAG,iBAAiB,SAAS;EAC7B,GAAG,mBAAmB,SAAS;EAC/B,GAAG,kBAAkB,SAAS;CAChC;AACF"}