@medalsocial/booking 0.0.0-placeholder.0 → 0.2.0

package/dist/next/options.d.mts

@@ -0,0 +1,158 @@
+import { BookingConfig } from "../core/config.mjs";
+import { CookieSource } from "../core/portal/cookies.mjs";
+import { MedalSeamOptions } from "./medal.mjs";
+//#region src/next/options.d.ts
+/**
+ * One cache the package reads through. Two of them back a booking site: the
+ * per-location EDGE cache (the booking seed and catalogue, a few ms to read)
+ * and the cross-isolate DATA cache (services, stylists, hours and free slots).
+ *
+ * `get`/`put`/`delete` are the contract every adapter keeps. The optional
+ * members are what a platform adds on top: tag expiry for a data cache, a
+ * background hand-off, a deploy version and a storage-key mapping for an
+ * edge cache, and a read-through `load` for a cache (Next's) that is a
+ * function wrapper rather than a key-value store.
+ */
+export interface BookingCacheAdapter {
+  /** The value under `key`, or `undefined` for a miss. May throw; callers treat a throw as a miss. */
+  get<T>(key: string): Promise<T | undefined>;
+  /** Store `value` for at most `ttlSeconds`. `tags` group entries for `expireTag`. */
+  put<T>(key: string, value: T, ttlSeconds: number, options?: {
+    tags?: readonly string[];
+  }): Promise<void>;
+  /** Drop `keys` — in this location only, for an edge cache. */
+  delete(keys: readonly string[]): Promise<void>;
+  /** Expire every entry stored under `tag`. */
+  expireTag?(tag: string): Promise<void>;
+  /**
+   * Hand background work to the platform (`ctx.waitUntil`, `after()`), so it
+   * outlives the response without holding it. Answers `false` when there is no
+   * hook for THIS request; the caller then awaits the work itself.
+   */
+  defer?(work: Promise<unknown>): boolean;
+  /**
+   * The storage key for a package key, or `null` when this adapter cannot
+   * store anything right now (off its platform, no origin configured). The
+   * default is the key itself.
+   */
+  key?(key: string): string | null;
+  /** The deployed version, mixed into edge keys so a deploy starts cold. */
+  version?(): string | undefined;
+  /**
+   * Read-through: the cached answer for `keyParts` + `args`, or `fill()`'s,
+   * stored for `ttlSeconds` under `tags`. Adapters without it get the
+   * `get`-then-`put` default (`cacheLoad`).
+   */
+  load?<T>(keyParts: readonly string[], args: readonly unknown[], fill: () => Promise<T>, options: {
+    ttlSeconds: number;
+    tags: readonly string[];
+  }): Promise<T>;
+}
+/**
+ * Pino's call shape — `(meta, message)` — which is what every log line in the
+ * package writes. `console` accepts it too.
+ */
+export interface BookingLogger {
+  info(meta: unknown, message?: string): void;
+  warn(meta: unknown, message?: string): void;
+  error(meta: unknown, message?: string): void;
+}
+/** The phases the package measures. Fixed strings: the header is public. */
+export type BookingTimingPhase = 'catalogue' | 'seed' | 'guardian';
+/**
+ * A `Server-Timing` sink. `meta.start` / `meta.end` are the span in
+ * `Date.now()` milliseconds; the seed phase also carries `meta.state`
+ * (`hit`, `stale`, `miss` or `bypass`).
+ */
+export type BookingTiming = (phase: BookingTimingPhase, ms: number, meta?: Record<string, string>) => void;
+/**
+ * The app's rate limiter, asked once per handler request before anything is
+ * read. `true` answers `429 { error: 'rateLimited' }`. `scope` is the route
+ * (`booking/create`, `portal/login/verify`, …).
+ */
+export type BookingRateLimit = (scope: string, request: Request) => boolean | Promise<boolean>;
+export interface BookingServerOptions {
+  /** The resolved, client-safe config (`resolveBookingConfig`). */
+  config: Readonly<BookingConfig>;
+  /**
+   * The Medal API key and origin. The app passes its own secrets in — as
+   * values, or as functions read on every call where the platform fills
+   * `process.env` per request (OpenNext on Workers). A missing or placeholder
+   * key fails as `MedalConfigError` when Medal is first asked, never at
+   * import.
+   */
+  medal: MedalSeamOptions;
+  cache: {
+    /** L1: per-location, few-ms reads (the booking seed and catalogue). */
+    edge: BookingCacheAdapter;
+    /** L2: cross-isolate data cache (services, stylists, hours, slots). */
+    data: BookingCacheAdapter;
+    /** Data-cache key prefix (the first key part of every L2 entry). */
+    prefix: string;
+    /** Edge-key path prefix. Default `/__medal-edge/booking-seed/v1`. */
+    edgePrefix?: string;
+    /** Added to every edge key, so staging and production on one zone never share. */
+    environment: string;
+  };
+  /** The cookie jar for this request. Default: `cookies()` from `next/headers`. */
+  cookies?: CookieSource;
+  timing?: BookingTiming;
+  logger?: BookingLogger;
+  rateLimit?: BookingRateLimit;
+  /**
+   * The origin to fall back on when a request names none (a server action
+   * with no host header): the site's canonical URL.
+   */
+  baseUrl?: string | (() => string | undefined);
+  /** The portal's server-side switches. Every field has a default. */
+  portal?: BookingPortalServerOptions;
+  /**
+   * The hosts the avatar route may fetch a stylist photo from: an exact
+   * hostname (`images.example.com`) or a `*.` suffix (`*.example.com`, which
+   * matches every subdomain but not the apex). Default
+   * `DEFAULT_AVATAR_HOSTS` — Medal's photo storage and Google profile
+   * pictures. Whatever is listed, the route only fetches `https:` on the
+   * default port, never an IP address, `localhost` or an internal name, and
+   * never follows a redirect.
+   */
+  avatarHosts?: readonly string[];
+}
+/**
+ * Where Medal's `photo_url` points: presigned Cloudflare R2 objects (Medal's
+ * own photo storage) and, for a stylist linked to a member with no photo of
+ * their own, that member's Google profile picture.
+ */
+export declare const DEFAULT_AVATAR_HOSTS: readonly string[];
+export interface BookingPortalServerOptions {
+  /**
+   * Whether the portal is on for THIS request, for a site whose switch lives
+   * in a CMS. Default `config.portal.enabled`.
+   */
+  enabled?: () => boolean | Promise<boolean>;
+  /** The «Vipps link» flash cookie. Default `<portal.cookieName>_vipps_flash`. */
+  vippsFlashCookieName?: string;
+  /** Where Vipps returns a login (the `vippsReturn` route). Default `<paths.portal>/vipps`. */
+  vippsReturnPath?: string;
+  /** Where Vipps returns a «link Vipps» (the `vippsLinkReturn` route). Default `<paths.portal>/vipps/link`. */
+  vippsLinkReturnPath?: string;
+  /** The word the delete-account form must carry. Default `'SLETT'`. */
+  deleteConfirmWord?: string;
+  /** The data export's file name, before `-<date>.json`. Default `'min-side-eksport'`. */
+  exportFilePrefix?: string;
+  /** The language of Medal's login e-mails. Default `'no'`. */
+  locale?: 'no' | 'en';
+  /** The validation sentences the portal's actions answer with. */
+  messages?: Partial<PortalMessages>;
+}
+/** The sentences the portal answers a form with. Norwegian by default. */
+export interface PortalMessages {
+  duplicateChild: string;
+  invalidChild: string;
+  childNotFound: string;
+  invalidPhone: string;
+  invalidBirthYear: string;
+}
+export declare const DEFAULT_PORTAL_MESSAGES: PortalMessages;
+export declare const DEFAULT_EDGE_PREFIX = "/__medal-edge/booking-seed/v1";
+//#endregion
+//# sourceMappingURL=options.d.mts.map

package/dist/next/options.mjs

@@ -0,0 +1,65 @@
+//#region src/next/options.ts
+/**
+* Where Medal's `photo_url` points: presigned Cloudflare R2 objects (Medal's
+* own photo storage) and, for a stylist linked to a member with no photo of
+* their own, that member's Google profile picture.
+*/
+const DEFAULT_AVATAR_HOSTS = Object.freeze(["*.r2.cloudflarestorage.com", "*.googleusercontent.com"]);
+const DEFAULT_PORTAL_MESSAGES = {
+	duplicateChild: "Dette barnet er allerede lagt inn.",
+	invalidChild: "Sjekk navn, fødselsår og måned.",
+	childNotFound: "Fant ikke barnet. Last siden på nytt og prøv igjen.",
+	invalidPhone: "Telefonnummeret må ha åtte siffer.",
+	invalidBirthYear: "Fødselsåret ser ikke riktig ut."
+};
+const DEFAULT_EDGE_PREFIX = "/__medal-edge/booking-seed/v1";
+const quiet = () => {};
+/** The default logger: silent. A site that wants the lines passes its own. */
+const SILENT_LOGGER = {
+	info: quiet,
+	warn: quiet,
+	error: quiet
+};
+/**
+* `work` measured into `timing` under `phase`, or just `work` when there is no
+* sink. `meta` is read after the work, so a phase can report how it ended.
+*/
+async function timed(timing, phase, work, meta) {
+	if (!timing) return work();
+	const start = Date.now();
+	try {
+		return await work();
+	} finally {
+		const end = Date.now();
+		timing(phase, end - start, {
+			start: String(start),
+			end: String(end),
+			...meta?.()
+		});
+	}
+}
+/**
+* Hand `work` to the adapter's `defer`, or await it where there is none.
+* Never throws: everything scheduled through here is an optimisation.
+*/
+async function inBackground(adapter, work) {
+	const settled = work.then(() => void 0, () => void 0);
+	if (adapter.defer?.(settled) === true) return;
+	await settled;
+}
+/** The read-through every adapter without its own `load` gets. */
+async function cacheLoad(adapter, keyParts, args, fill, options) {
+	if (adapter.load) return adapter.load(keyParts, args, fill, options);
+	const path = `/${[...keyParts, JSON.stringify(args)].map(encodeURIComponent).join("/")}`;
+	const key = adapter.key ? adapter.key(path) : path;
+	if (key === null) return fill();
+	const hit = await adapter.get(key).catch(() => void 0);
+	if (hit !== void 0) return hit;
+	const value = await fill();
+	await adapter.put(key, value, options.ttlSeconds, { tags: options.tags }).catch(() => void 0);
+	return value;
+}
+//#endregion
+export { DEFAULT_AVATAR_HOSTS, DEFAULT_EDGE_PREFIX, DEFAULT_PORTAL_MESSAGES, SILENT_LOGGER, cacheLoad, inBackground, timed };
+
+//# sourceMappingURL=options.mjs.map

package/dist/next/options.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.mjs","names":[],"sources":["../../src/next/options.ts"],"sourcesContent":["/**\n * What a site hands the server half of the booking package.\n *\n * Split from `BookingConfig` by TRUST. The config is client-safe and goes into\n * the page as a prop; everything here — the Medal key, the cache handles, the\n * cookie jar, the logger — stays on the server and is never serialised.\n *\n * The package reads NO environment variable. A site passes its own key in\n * (`process.env.MEDAL_API_KEY` in a Next app), so the name of the variable,\n * the secret manager behind it and the moment it is read are all the app's.\n */\n\nimport type { BookingConfig } from '../core/config';\nimport type { CookieSource } from '../core/portal/cookies';\nimport type { MedalSeamOptions } from './medal';\n\n/**\n * One cache the package reads through. Two of them back a booking site: the\n * per-location EDGE cache (the booking seed and catalogue, a few ms to read)\n * and the cross-isolate DATA cache (services, stylists, hours and free slots).\n *\n * `get`/`put`/`delete` are the contract every adapter keeps. The optional\n * members are what a platform adds on top: tag expiry for a data cache, a\n * background hand-off, a deploy version and a storage-key mapping for an\n * edge cache, and a read-through `load` for a cache (Next's) that is a\n * function wrapper rather than a key-value store.\n */\nexport interface BookingCacheAdapter {\n  /** The value under `key`, or `undefined` for a miss. May throw; callers treat a throw as a miss. */\n  get<T>(key: string): Promise<T | undefined>;\n  /** Store `value` for at most `ttlSeconds`. `tags` group entries for `expireTag`. */\n  put<T>(\n    key: string,\n    value: T,\n    ttlSeconds: number,\n    options?: { tags?: readonly string[] }\n  ): Promise<void>;\n  /** Drop `keys` — in this location only, for an edge cache. */\n  delete(keys: readonly string[]): Promise<void>;\n  /** Expire every entry stored under `tag`. */\n  expireTag?(tag: string): Promise<void>;\n  /**\n   * Hand background work to the platform (`ctx.waitUntil`, `after()`), so it\n   * outlives the response without holding it. Answers `false` when there is no\n   * hook for THIS request; the caller then awaits the work itself.\n   */\n  defer?(work: Promise<unknown>): boolean;\n  /**\n   * The storage key for a package key, or `null` when this adapter cannot\n   * store anything right now (off its platform, no origin configured). The\n   * default is the key itself.\n   */\n  key?(key: string): string | null;\n  /** The deployed version, mixed into edge keys so a deploy starts cold. */\n  version?(): string | undefined;\n  /**\n   * Read-through: the cached answer for `keyParts` + `args`, or `fill()`'s,\n   * stored for `ttlSeconds` under `tags`. Adapters without it get the\n   * `get`-then-`put` default (`cacheLoad`).\n   */\n  load?<T>(\n    keyParts: readonly string[],\n    args: readonly unknown[],\n    fill: () => Promise<T>,\n    options: { ttlSeconds: number; tags: readonly string[] }\n  ): Promise<T>;\n}\n\n/**\n * Pino's call shape — `(meta, message)` — which is what every log line in the\n * package writes. `console` accepts it too.\n */\nexport interface BookingLogger {\n  info(meta: unknown, message?: string): void;\n  warn(meta: unknown, message?: string): void;\n  error(meta: unknown, message?: string): void;\n}\n\n/** The phases the package measures. Fixed strings: the header is public. */\nexport type BookingTimingPhase = 'catalogue' | 'seed' | 'guardian';\n\n/**\n * A `Server-Timing` sink. `meta.start` / `meta.end` are the span in\n * `Date.now()` milliseconds; the seed phase also carries `meta.state`\n * (`hit`, `stale`, `miss` or `bypass`).\n */\nexport type BookingTiming = (\n  phase: BookingTimingPhase,\n  ms: number,\n  meta?: Record<string, string>\n) => void;\n\n/**\n * The app's rate limiter, asked once per handler request before anything is\n * read. `true` answers `429 { error: 'rateLimited' }`. `scope` is the route\n * (`booking/create`, `portal/login/verify`, …).\n */\nexport type BookingRateLimit = (scope: string, request: Request) => boolean | Promise<boolean>;\n\nexport interface BookingServerOptions {\n  /** The resolved, client-safe config (`resolveBookingConfig`). */\n  config: Readonly<BookingConfig>;\n  /**\n   * The Medal API key and origin. The app passes its own secrets in — as\n   * values, or as functions read on every call where the platform fills\n   * `process.env` per request (OpenNext on Workers). A missing or placeholder\n   * key fails as `MedalConfigError` when Medal is first asked, never at\n   * import.\n   */\n  medal: MedalSeamOptions;\n  cache: {\n    /** L1: per-location, few-ms reads (the booking seed and catalogue). */\n    edge: BookingCacheAdapter;\n    /** L2: cross-isolate data cache (services, stylists, hours, slots). */\n    data: BookingCacheAdapter;\n    /** Data-cache key prefix (the first key part of every L2 entry). */\n    prefix: string;\n    /** Edge-key path prefix. Default `/__medal-edge/booking-seed/v1`. */\n    edgePrefix?: string;\n    /** Added to every edge key, so staging and production on one zone never share. */\n    environment: string;\n  };\n  /** The cookie jar for this request. Default: `cookies()` from `next/headers`. */\n  cookies?: CookieSource;\n  timing?: BookingTiming;\n  logger?: BookingLogger;\n  rateLimit?: BookingRateLimit;\n  /**\n   * The origin to fall back on when a request names none (a server action\n   * with no host header): the site's canonical URL.\n   */\n  baseUrl?: string | (() => string | undefined);\n  /** The portal's server-side switches. Every field has a default. */\n  portal?: BookingPortalServerOptions;\n  /**\n   * The hosts the avatar route may fetch a stylist photo from: an exact\n   * hostname (`images.example.com`) or a `*.` suffix (`*.example.com`, which\n   * matches every subdomain but not the apex). Default\n   * `DEFAULT_AVATAR_HOSTS` — Medal's photo storage and Google profile\n   * pictures. Whatever is listed, the route only fetches `https:` on the\n   * default port, never an IP address, `localhost` or an internal name, and\n   * never follows a redirect.\n   */\n  avatarHosts?: readonly string[];\n}\n\n/**\n * Where Medal's `photo_url` points: presigned Cloudflare R2 objects (Medal's\n * own photo storage) and, for a stylist linked to a member with no photo of\n * their own, that member's Google profile picture.\n */\nexport const DEFAULT_AVATAR_HOSTS: readonly string[] = Object.freeze([\n  '*.r2.cloudflarestorage.com',\n  '*.googleusercontent.com',\n]);\n\nexport interface BookingPortalServerOptions {\n  /**\n   * Whether the portal is on for THIS request, for a site whose switch lives\n   * in a CMS. Default `config.portal.enabled`.\n   */\n  enabled?: () => boolean | Promise<boolean>;\n  /** The «Vipps link» flash cookie. Default `<portal.cookieName>_vipps_flash`. */\n  vippsFlashCookieName?: string;\n  /** Where Vipps returns a login (the `vippsReturn` route). Default `<paths.portal>/vipps`. */\n  vippsReturnPath?: string;\n  /** Where Vipps returns a «link Vipps» (the `vippsLinkReturn` route). Default `<paths.portal>/vipps/link`. */\n  vippsLinkReturnPath?: string;\n  /** The word the delete-account form must carry. Default `'SLETT'`. */\n  deleteConfirmWord?: string;\n  /** The data export's file name, before `-<date>.json`. Default `'min-side-eksport'`. */\n  exportFilePrefix?: string;\n  /** The language of Medal's login e-mails. Default `'no'`. */\n  locale?: 'no' | 'en';\n  /** The validation sentences the portal's actions answer with. */\n  messages?: Partial<PortalMessages>;\n}\n\n/** The sentences the portal answers a form with. Norwegian by default. */\nexport interface PortalMessages {\n  duplicateChild: string;\n  invalidChild: string;\n  childNotFound: string;\n  invalidPhone: string;\n  invalidBirthYear: string;\n}\n\nexport const DEFAULT_PORTAL_MESSAGES: PortalMessages = {\n  duplicateChild: 'Dette barnet er allerede lagt inn.',\n  invalidChild: 'Sjekk navn, fødselsår og måned.',\n  childNotFound: 'Fant ikke barnet. Last siden på nytt og prøv igjen.',\n  invalidPhone: 'Telefonnummeret må ha åtte siffer.',\n  invalidBirthYear: 'Fødselsåret ser ikke riktig ut.',\n};\n\nexport const DEFAULT_EDGE_PREFIX = '/__medal-edge/booking-seed/v1';\n\nconst quiet = () => {};\n\n/** The default logger: silent. A site that wants the lines passes its own. */\nexport const SILENT_LOGGER: BookingLogger = { info: quiet, warn: quiet, error: quiet };\n\n/**\n * `work` measured into `timing` under `phase`, or just `work` when there is no\n * sink. `meta` is read after the work, so a phase can report how it ended.\n */\nexport async function timed<T>(\n  timing: BookingTiming | undefined,\n  phase: BookingTimingPhase,\n  work: () => Promise<T>,\n  meta?: () => Record<string, string> | undefined\n): Promise<T> {\n  if (!timing) return work();\n  const start = Date.now();\n  try {\n    return await work();\n  } finally {\n    const end = Date.now();\n    timing(phase, end - start, { start: String(start), end: String(end), ...meta?.() });\n  }\n}\n\n/**\n * Hand `work` to the adapter's `defer`, or await it where there is none.\n * Never throws: everything scheduled through here is an optimisation.\n */\nexport async function inBackground(\n  adapter: Pick<BookingCacheAdapter, 'defer'>,\n  work: Promise<unknown>\n): Promise<void> {\n  const settled = work.then(\n    () => undefined,\n    () => undefined\n  );\n  if (adapter.defer?.(settled) === true) return;\n  await settled;\n}\n\n/** The read-through every adapter without its own `load` gets. */\nexport async function cacheLoad<T>(\n  adapter: BookingCacheAdapter,\n  keyParts: readonly string[],\n  args: readonly unknown[],\n  fill: () => Promise<T>,\n  options: { ttlSeconds: number; tags: readonly string[] }\n): Promise<T> {\n  if (adapter.load) return adapter.load(keyParts, args, fill, options);\n  // A path, so an adapter that keys by URL (the Workers cache) can store it.\n  const path = `/${[...keyParts, JSON.stringify(args)].map(encodeURIComponent).join('/')}`;\n  const key = adapter.key ? adapter.key(path) : path;\n  if (key === null) return fill();\n  const hit = await adapter.get<T>(key).catch(() => undefined);\n  if (hit !== undefined) return hit;\n  const value = await fill();\n  await adapter.put(key, value, options.ttlSeconds, { tags: options.tags }).catch(() => undefined);\n  return value;\n}\n"],"mappings":";;;;;;AAuJA,MAAa,uBAA0C,OAAO,OAAO,CACnE,8BACA,yBACF,CAAC;AAiCD,MAAa,0BAA0C;CACrD,gBAAgB;CAChB,cAAc;CACd,eAAe;CACf,cAAc;CACd,kBAAkB;AACpB;AAEA,MAAa,sBAAsB;AAEnC,MAAM,cAAc,CAAC;;AAGrB,MAAa,gBAA+B;CAAE,MAAM;CAAO,MAAM;CAAO,OAAO;AAAM;;;;;AAMrF,eAAsB,MACpB,QACA,OACA,MACA,MACY;CACZ,IAAI,CAAC,QAAQ,OAAO,KAAK;CACzB,MAAM,QAAQ,KAAK,IAAI;CACvB,IAAI;EACF,OAAO,MAAM,KAAK;CACpB,UAAU;EACR,MAAM,MAAM,KAAK,IAAI;EACrB,OAAO,OAAO,MAAM,OAAO;GAAE,OAAO,OAAO,KAAK;GAAG,KAAK,OAAO,GAAG;GAAG,GAAG,OAAO;EAAE,CAAC;CACpF;AACF;;;;;AAMA,eAAsB,aACpB,SACA,MACe;CACf,MAAM,UAAU,KAAK,WACb,KAAA,SACA,KAAA,CACR;CACA,IAAI,QAAQ,QAAQ,OAAO,MAAM,MAAM;CACvC,MAAM;AACR;;AAGA,eAAsB,UACpB,SACA,UACA,MACA,MACA,SACY;CACZ,IAAI,QAAQ,MAAM,OAAO,QAAQ,KAAK,UAAU,MAAM,MAAM,OAAO;CAEnE,MAAM,OAAO,IAAI,CAAC,GAAG,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;CACrF,MAAM,MAAM,QAAQ,MAAM,QAAQ,IAAI,IAAI,IAAI;CAC9C,IAAI,QAAQ,MAAM,OAAO,KAAK;CAC9B,MAAM,MAAM,MAAM,QAAQ,IAAO,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;CAC3D,IAAI,QAAQ,KAAA,GAAW,OAAO;CAC9B,MAAM,QAAQ,MAAM,KAAK;CACzB,MAAM,QAAQ,IAAI,KAAK,OAAO,QAAQ,YAAY,EAAE,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;CAC/F,OAAO;AACT"}

package/dist/next/portal/guardian.d.mts

@@ -0,0 +1,42 @@
+import { BookingFamilyMember, BookingGuardian } from "../../core/types.mjs";
+import { PortalBookingDto, PortalFamilyMemberDto } from "../../core/portal/dto.mjs";
+import { BookingLogger } from "../options.mjs";
+import { PortalSeam } from "./medal-portal.mjs";
+//#region src/next/portal/guardian.d.ts
+/**
+ * One child, narrowed for the browser: the id, the name, the year and month
+ * the wizard computes an age from, and the stylist a card can preselect.
+ * `notes` (the note for the stylist) stays behind — it is for the salon, and the
+ * wizard renders none of it. Nulls become absent keys, the wizard's rule.
+ */
+export declare function toBookingFamilyMember(member: PortalFamilyMemberDto, lastVisit?: PortalBookingDto | null): BookingFamilyMember;
+/**
+ * The logged-in parent, as the booking wizard is allowed to see them.
+ *
+ * Two callers, one answer, and the reason this is a module rather than a
+ * function in the booking page: the page asks it on the way in (a parent
+ * who arrived holding a Min side cookie), and `POST /api/portal/login/verify`
+ * asks it the moment an e-mail code has been accepted, so the wizard can fill
+ * its fields in place instead of refreshing a whole server page to find out
+ * who just logged in. A second copy of the narrowing in the route would be a
+ * second place for the `contactId` or the marketing flag to leak into the
+ * browser from.
+ *
+ * Takes the SESSION rather than reading the jar, because the route has the
+ * token in hand before any cookie exists to read — and a handler reading back
+ * its own `Set-Cookie` in the same request is not something to lean on.
+ *
+ * BEST EFFORT IN EVERY DIRECTION. A session Medal no longer honours, or Medal
+ * being unreachable, is `null` and a warning — never a throw and never a
+ * redirect. On the booking page that is a parent the page could not identify, who
+ * books like everybody else; after a login it is a parent who is logged in but
+ * whose fields the wizard cannot prefill, which is the same form they would
+ * have typed into anyway.
+ *
+ * The narrowing to `BookingGuardian` is deliberate and happens HERE, on the
+ * server: `contactId`, the marketing flag and the bransjemal labels stay behind
+ * because the wizard renders none of them.
+ */
+export declare function createGuardian(portal: Pick<PortalSeam, 'getMe' | 'getMyBookings'>, logger: BookingLogger): (session: string) => Promise<BookingGuardian | null>;
+//#endregion
+//# sourceMappingURL=guardian.d.mts.map

package/dist/next/portal/guardian.mjs

@@ -0,0 +1,76 @@
+import { completedNewestFirst, firstBookingFor } from "../../core/portal/family.mjs";
+//#region src/next/portal/guardian.ts
+/**
+* One child, narrowed for the browser: the id, the name, the year and month
+* the wizard computes an age from, and the stylist a card can preselect.
+* `notes` (the note for the stylist) stays behind — it is for the salon, and the
+* wizard renders none of it. Nulls become absent keys, the wizard's rule.
+*/
+function toBookingFamilyMember(member, lastVisit = null) {
+	return {
+		name: member.name,
+		birthYear: member.birthYear,
+		...member.personId === null ? {} : { personId: member.personId },
+		...member.birthMonth === null ? {} : { birthMonth: member.birthMonth },
+		...member.preferredResourceId === null ? {} : { preferredResourceId: member.preferredResourceId },
+		...lastVisit?.serviceId ? { lastVisit: {
+			serviceId: lastVisit.serviceId,
+			serviceName: lastVisit.serviceName,
+			resourceId: lastVisit.resourceId,
+			startTs: lastVisit.startTs
+		} } : {}
+	};
+}
+/**
+* The logged-in parent, as the booking wizard is allowed to see them.
+*
+* Two callers, one answer, and the reason this is a module rather than a
+* function in the booking page: the page asks it on the way in (a parent
+* who arrived holding a Min side cookie), and `POST /api/portal/login/verify`
+* asks it the moment an e-mail code has been accepted, so the wizard can fill
+* its fields in place instead of refreshing a whole server page to find out
+* who just logged in. A second copy of the narrowing in the route would be a
+* second place for the `contactId` or the marketing flag to leak into the
+* browser from.
+*
+* Takes the SESSION rather than reading the jar, because the route has the
+* token in hand before any cookie exists to read — and a handler reading back
+* its own `Set-Cookie` in the same request is not something to lean on.
+*
+* BEST EFFORT IN EVERY DIRECTION. A session Medal no longer honours, or Medal
+* being unreachable, is `null` and a warning — never a throw and never a
+* redirect. On the booking page that is a parent the page could not identify, who
+* books like everybody else; after a login it is a parent who is logged in but
+* whose fields the wizard cannot prefill, which is the same form they would
+* have typed into anyway.
+*
+* The narrowing to `BookingGuardian` is deliberate and happens HERE, on the
+* server: `contactId`, the marketing flag and the bransjemal labels stay behind
+* because the wizard renders none of them.
+*/
+function createGuardian(portal, logger) {
+	const { getMe, getMyBookings } = portal;
+	return async function guardianFromSession(session) {
+		try {
+			const [profile, bookings] = await Promise.all([getMe(session), getMyBookings(session).catch((error) => {
+				logger.warn({ err: error }, "Could not read past bookings for the booking wizard");
+				return null;
+			})]);
+			const last = firstBookingFor(profile.family, completedNewestFirst(bookings?.past ?? []));
+			return {
+				firstName: profile.firstName,
+				lastName: profile.lastName,
+				email: profile.email,
+				phone: profile.phone,
+				family: profile.family.map((member, index) => toBookingFamilyMember(member, last[index]))
+			};
+		} catch (error) {
+			logger.warn({ err: error }, "Could not read the Min side profile for the booking wizard");
+			return null;
+		}
+	};
+}
+//#endregion
+export { createGuardian, toBookingFamilyMember };
+
+//# sourceMappingURL=guardian.mjs.map

package/dist/next/portal/guardian.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian.mjs","names":[],"sources":["../../../src/next/portal/guardian.ts"],"sourcesContent":["import type { PortalBookingDto, PortalFamilyMemberDto } from '../../core/portal/dto';\nimport { completedNewestFirst, firstBookingFor } from '../../core/portal/family';\nimport type { BookingFamilyMember, BookingGuardian } from '../../core/types';\nimport type { BookingLogger } from '../options';\nimport type { PortalSeam } from './medal-portal';\n\n/**\n * One child, narrowed for the browser: the id, the name, the year and month\n * the wizard computes an age from, and the stylist a card can preselect.\n * `notes` (the note for the stylist) stays behind — it is for the salon, and the\n * wizard renders none of it. Nulls become absent keys, the wizard's rule.\n */\nexport function toBookingFamilyMember(\n  member: PortalFamilyMemberDto,\n  lastVisit: PortalBookingDto | null = null\n): BookingFamilyMember {\n  return {\n    name: member.name,\n    birthYear: member.birthYear,\n    ...(member.personId === null ? {} : { personId: member.personId }),\n    ...(member.birthMonth === null ? {} : { birthMonth: member.birthMonth }),\n    ...(member.preferredResourceId === null\n      ? {}\n      : { preferredResourceId: member.preferredResourceId }),\n    ...(lastVisit?.serviceId\n      ? {\n          lastVisit: {\n            serviceId: lastVisit.serviceId,\n            serviceName: lastVisit.serviceName,\n            resourceId: lastVisit.resourceId,\n            startTs: lastVisit.startTs,\n          },\n        }\n      : {}),\n  };\n}\n\n/**\n * The logged-in parent, as the booking wizard is allowed to see them.\n *\n * Two callers, one answer, and the reason this is a module rather than a\n * function in the booking page: the page asks it on the way in (a parent\n * who arrived holding a Min side cookie), and `POST /api/portal/login/verify`\n * asks it the moment an e-mail code has been accepted, so the wizard can fill\n * its fields in place instead of refreshing a whole server page to find out\n * who just logged in. A second copy of the narrowing in the route would be a\n * second place for the `contactId` or the marketing flag to leak into the\n * browser from.\n *\n * Takes the SESSION rather than reading the jar, because the route has the\n * token in hand before any cookie exists to read — and a handler reading back\n * its own `Set-Cookie` in the same request is not something to lean on.\n *\n * BEST EFFORT IN EVERY DIRECTION. A session Medal no longer honours, or Medal\n * being unreachable, is `null` and a warning — never a throw and never a\n * redirect. On the booking page that is a parent the page could not identify, who\n * books like everybody else; after a login it is a parent who is logged in but\n * whose fields the wizard cannot prefill, which is the same form they would\n * have typed into anyway.\n *\n * The narrowing to `BookingGuardian` is deliberate and happens HERE, on the\n * server: `contactId`, the marketing flag and the bransjemal labels stay behind\n * because the wizard renders none of them.\n */\nexport function createGuardian(\n  portal: Pick<PortalSeam, 'getMe' | 'getMyBookings'>,\n  logger: BookingLogger\n): (session: string) => Promise<BookingGuardian | null> {\n  const { getMe, getMyBookings } = portal;\n  return async function guardianFromSession(session: string): Promise<BookingGuardian | null> {\n    try {\n      // The bookings only feed each child's «Sist: …» and step 2's «Samme som\n      // sist», so they are best effort within best effort: a failed read is a\n      // family without last visits, not a parent the wizard cannot recognise.\n      const [profile, bookings] = await Promise.all([\n        getMe(session),\n        getMyBookings(session).catch((error: unknown) => {\n          logger.warn({ err: error }, 'Could not read past bookings for the booking wizard');\n          return null;\n        }),\n      ]);\n      const last = firstBookingFor(profile.family, completedNewestFirst(bookings?.past ?? []));\n      return {\n        firstName: profile.firstName,\n        lastName: profile.lastName,\n        email: profile.email,\n        phone: profile.phone,\n        family: profile.family.map((member, index) => toBookingFamilyMember(member, last[index])),\n      };\n    } catch (error) {\n      // The seam has already scrubbed the session out of this.\n      logger.warn({ err: error }, 'Could not read the Min side profile for the booking wizard');\n      return null;\n    }\n  };\n}\n"],"mappings":";;;;;;;;AAYA,SAAgB,sBACd,QACA,YAAqC,MAChB;CACrB,OAAO;EACL,MAAM,OAAO;EACb,WAAW,OAAO;EAClB,GAAI,OAAO,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;EAChE,GAAI,OAAO,eAAe,OAAO,CAAC,IAAI,EAAE,YAAY,OAAO,WAAW;EACtE,GAAI,OAAO,wBAAwB,OAC/B,CAAC,IACD,EAAE,qBAAqB,OAAO,oBAAoB;EACtD,GAAI,WAAW,YACX,EACE,WAAW;GACT,WAAW,UAAU;GACrB,aAAa,UAAU;GACvB,YAAY,UAAU;GACtB,SAAS,UAAU;EACrB,EACF,IACA,CAAC;CACP;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAgB,eACd,QACA,QACsD;CACtD,MAAM,EAAE,OAAO,kBAAkB;CACjC,OAAO,eAAe,oBAAoB,SAAkD;EAC1F,IAAI;GAIF,MAAM,CAAC,SAAS,YAAY,MAAM,QAAQ,IAAI,CAC5C,MAAM,OAAO,GACb,cAAc,OAAO,CAAC,CAAC,OAAO,UAAmB;IAC/C,OAAO,KAAK,EAAE,KAAK,MAAM,GAAG,qDAAqD;IACjF,OAAO;GACT,CAAC,CACH,CAAC;GACD,MAAM,OAAO,gBAAgB,QAAQ,QAAQ,qBAAqB,UAAU,QAAQ,CAAC,CAAC,CAAC;GACvF,OAAO;IACL,WAAW,QAAQ;IACnB,UAAU,QAAQ;IAClB,OAAO,QAAQ;IACf,OAAO,QAAQ;IACf,QAAQ,QAAQ,OAAO,KAAK,QAAQ,UAAU,sBAAsB,QAAQ,KAAK,MAAM,CAAC;GAC1F;EACF,SAAS,OAAO;GAEd,OAAO,KAAK,EAAE,KAAK,MAAM,GAAG,4DAA4D;GACxF,OAAO;EACT;CACF;AACF"}

package/dist/next/portal/medal-portal.d.mts

@@ -0,0 +1,161 @@
+import { BookingConfig } from "../../core/config.mjs";
+import { PortalBookingDto, PortalProfileDto } from "../../core/portal/dto.mjs";
+import { MedalSeam } from "../medal.mjs";
+import { PortalMessages } from "../options.mjs";
+import { PortalExport, PortalLocale, PortalProfilePatch } from "@medalsocial/sdk";
+//#region src/next/portal/medal-portal.d.ts
+/**
+ * The portal seam: everything `/min-side` asks Medal, in this site's own terms.
+ *
+ * The sibling of `lib/booking/medal-client.ts`, and built on the same SDK. The
+ * difference is the credential. The booking seam carries a per-appointment
+ * manage token on a handful of calls; every call here except the two login
+ * steps carries the parent's SESSION — a bearer credential for their whole
+ * account, read from the session cookie by `portal/session.ts` and
+ * handed in as a plain string. This module is the last place that string is
+ * known by name before it goes on the wire, which makes it the last place two
+ * things can be guaranteed:
+ *
+ * 1. **It is not in any error that leaves here.** The SDK formats the failing
+ *    request into its messages, and the session travels in a header of that
+ *    request; whatever an action lets escape is logged verbatim by
+ *    `next-safe-action`'s error handler and a log is copied to places a cookie
+ *    is not. `withSession` scrubs the value out of the message and stack of
+ *    anything it rethrows — the same instance, so `instanceof`, `status` and
+ *    `code` still hold for whoever catches it.
+ * 2. **It is never logged here.** There is no `logger` import in this file on
+ *    purpose. The one thing a log line about a portal failure must not contain
+ *    is the thing every function in this file holds.
+ *
+ * Two errors are this module's own vocabulary, because two upstream answers
+ * are decisions for the page rather than failures: `PortalSessionExpiredError`
+ * (Medal no longer honours the cookie — clear it and send the parent back to
+ * the login) and `PortalThrottledError` (Medal is rate-limiting this address —
+ * the login copy already says «if we have your address, a code is on its way»,
+ * and a throttle must not become an oracle for which addresses exist).
+ * `PortalValidationError` carries the engine's message for a rejected profile
+ * edit; it is written for integrators and quotes wire field names, so the form
+ * should prefer its own copy and fall back to this.
+ */
+/** Medal answered 401 with a `PORTAL_SESSION_*` code: the cookie is dead. */
+export declare class PortalSessionExpiredError extends Error {
+  constructor();
+}
+/** Medal answered 429: this address has asked for too many codes. */
+export declare class PortalThrottledError extends Error {
+  constructor();
+}
+/** Medal rejected a profile edit; `message` is the engine's own sentence. */
+export declare class PortalValidationError extends Error {
+  constructor(message: string);
+}
+/**
+ * Medal answered 503 `VIPPS_NOT_CONFIGURED`: this workspace has no Vipps
+ * credentials (yet). A decision for the login page — show the e-mail form
+ * and say so — not a failure.
+ */
+export declare class PortalVippsUnavailableError extends Error {
+  constructor();
+}
+/** One child as the editor writes it, in this site's own terms. */
+export interface PortalPersonInput {
+  name: string;
+  birthYear: number;
+  /** `null` clears; absent leaves it alone. */
+  birthMonth?: number | null;
+  notes?: string | null;
+  preferredResourceId?: string | null;
+}
+/** What a person edit reports: the profile as Medal now holds it, and whether
+ * the SP10 route was there to take the details. */
+export interface PortalPersonResult {
+  profile: PortalProfileDto;
+  /** The id of the child just created or edited, when the profile can name it. */
+  personId: string | null;
+  fallback: boolean;
+}
+/**
+ * Which child an edit is about. `personId` wherever the profile named one;
+ * `index` into the profile's family only for the rare row it could not (two
+ * same-named, same-year children against a Medal that sends no ids), which
+ * only the list-replacing fallback can address.
+ */
+export interface PersonTarget {
+  personId?: string | null;
+  index?: number;
+}
+/**
+ * Medal answered 409 `VIPPS_IDENTITY_CONFLICT` to a pending-link code: the code
+ * was right, but this Vipps account has since been bound to another customer.
+ * An answer for the login sheet — «log in with e-mail, or ring the salon».
+ */
+export declare class PortalVippsConflictError extends Error {
+  constructor();
+}
+/** How a link grant ended: linked, bound to another profile, or not honoured. */
+export type VippsLinkCompletion = 'linked' | 'conflict' | 'invalid';
+type Seam = Pick<MedalSeam, 'requireMedal' | 'requireMedalWithTimeout' | 'requireMedalConfig'>;
+export interface PortalSeamOptions {
+  config: Pick<BookingConfig, 'paths'>;
+  messages?: Partial<PortalMessages>;
+}
+/** The portal seam over one Medal seam. */
+export declare function createPortalSeam(medal: Seam, options: PortalSeamOptions): {
+  startLogin: (email: string, locale?: PortalLocale) => Promise<void>;
+  verifyLogin: (email: string, code: string) => Promise<{
+    sessionToken: string;
+    expiresAt: number;
+  } | null>;
+  logout: (session: string) => Promise<void>;
+  getMe: (session: string) => Promise<PortalProfileDto>;
+  updateMe: (session: string, patch: PortalProfilePatch) => Promise<PortalProfileDto>;
+  getMyBookings: (session: string) => Promise<{
+    upcoming: PortalBookingDto[];
+    past: PortalBookingDto[];
+  }>;
+  exportMyData: (session: string) => Promise<PortalExport>;
+  deleteMe: (session: string) => Promise<void>;
+  startVippsLogin: ({ returnUrl, browserBinding, locale }: {
+    returnUrl: string;
+    /**
+     * SP10: the value this site keeps in the browser-binding cookie, so a pending link
+     * Medal offers can only be confirmed from this browser (`vipps-link.ts`).
+     * A Medal without it ignores the key.
+     */
+    browserBinding?: string;
+    /** The language of the code e-mail a conflicted login sends. */
+    locale?: 'no' | 'en';
+  }) => Promise<{
+    authorizeUrl: string;
+  }>;
+  exchangeVippsGrant: (grant: string) => Promise<{
+    sessionToken: string;
+    expiresAt: number;
+  } | null>;
+  createPerson: (session: string, input: PortalPersonInput) => Promise<PortalPersonResult>;
+  updatePerson: (session: string, target: PersonTarget, patch: Partial<PortalPersonInput>) => Promise<PortalPersonResult>;
+  removePerson: (session: string, target: PersonTarget) => Promise<PortalPersonResult>;
+  verifyVippsLink: ({ link, code, browserBinding }: {
+    link: string;
+    code: string;
+    /** Mandatory: Medal refuses a verify without the binding the login started with. */
+    browserBinding: string;
+  }) => Promise<{
+    sessionToken: string;
+    expiresAt: number;
+  } | null>;
+  startVippsLink: (session: string, { returnUrl, browserBinding, locale }: {
+    returnUrl: string;
+    browserBinding: string;
+    locale?: 'no' | 'en';
+  }) => Promise<{
+    authorizeUrl: string;
+  } | null>;
+  completeVippsLink: (session: string, { grant, browserBinding }: {
+    grant: string;
+    browserBinding: string;
+  }) => Promise<VippsLinkCompletion>;
+};
+export type PortalSeam = ReturnType<typeof createPortalSeam>;
+//#endregion
+//# sourceMappingURL=medal-portal.d.mts.map