@medalsocial/booking 0.0.0-placeholder.0 → 0.2.0

package/dist/next/portal/medal-portal.mjs

@@ -0,0 +1,825 @@
+import { createPortalDto, toPortalProfileDto } from "../../core/portal/dto.mjs";
+import { DEFAULT_PORTAL_MESSAGES } from "../options.mjs";
+import { unwrap } from "../medal.mjs";
+import { MedalApiError } from "@medalsocial/sdk";
+//#region src/next/portal/medal-portal.ts
+/**
+* The portal seam: everything `/min-side` asks Medal, in this site's own terms.
+*
+* The sibling of `lib/booking/medal-client.ts`, and built on the same SDK. The
+* difference is the credential. The booking seam carries a per-appointment
+* manage token on a handful of calls; every call here except the two login
+* steps carries the parent's SESSION — a bearer credential for their whole
+* account, read from the session cookie by `portal/session.ts` and
+* handed in as a plain string. This module is the last place that string is
+* known by name before it goes on the wire, which makes it the last place two
+* things can be guaranteed:
+*
+* 1. **It is not in any error that leaves here.** The SDK formats the failing
+*    request into its messages, and the session travels in a header of that
+*    request; whatever an action lets escape is logged verbatim by
+*    `next-safe-action`'s error handler and a log is copied to places a cookie
+*    is not. `withSession` scrubs the value out of the message and stack of
+*    anything it rethrows — the same instance, so `instanceof`, `status` and
+*    `code` still hold for whoever catches it.
+* 2. **It is never logged here.** There is no `logger` import in this file on
+*    purpose. The one thing a log line about a portal failure must not contain
+*    is the thing every function in this file holds.
+*
+* Two errors are this module's own vocabulary, because two upstream answers
+* are decisions for the page rather than failures: `PortalSessionExpiredError`
+* (Medal no longer honours the cookie — clear it and send the parent back to
+* the login) and `PortalThrottledError` (Medal is rate-limiting this address —
+* the login copy already says «if we have your address, a code is on its way»,
+* and a throttle must not become an oracle for which addresses exist).
+* `PortalValidationError` carries the engine's message for a rejected profile
+* edit; it is written for integrators and quotes wire field names, so the form
+* should prefer its own copy and fall back to this.
+*/
+/** Medal answered 401 with a `PORTAL_SESSION_*` code: the cookie is dead. */
+var PortalSessionExpiredError = class extends Error {
+	constructor() {
+		super("portal session expired");
+		this.name = "PortalSessionExpiredError";
+	}
+};
+/** Medal answered 429: this address has asked for too many codes. */
+var PortalThrottledError = class extends Error {
+	constructor() {
+		super("portal request throttled");
+		this.name = "PortalThrottledError";
+	}
+};
+/** Medal rejected a profile edit; `message` is the engine's own sentence. */
+var PortalValidationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PortalValidationError";
+	}
+};
+/**
+* Medal answered 503 `VIPPS_NOT_CONFIGURED`: this workspace has no Vipps
+* credentials (yet). A decision for the login page — show the e-mail form
+* and say so — not a failure.
+*/
+var PortalVippsUnavailableError = class extends Error {
+	constructor() {
+		super("vipps login unavailable");
+		this.name = "PortalVippsUnavailableError";
+	}
+};
+/**
+* Medal answered 409 `VIPPS_IDENTITY_CONFLICT` to a pending-link code: the code
+* was right, but this Vipps account has since been bound to another customer.
+* An answer for the login sheet — «log in with e-mail, or ring the salon».
+*/
+var PortalVippsConflictError = class extends Error {
+	constructor() {
+		super("vipps identity conflict");
+		this.name = "PortalVippsConflictError";
+	}
+};
+/** The portal seam over one Medal seam. */
+function createPortalSeam(medal, options) {
+	const messages = {
+		...DEFAULT_PORTAL_MESSAGES,
+		...options.messages
+	};
+	const { toPortalBookingDto } = createPortalDto(options.config);
+	/**
+	* The SDK's portal namespace (`Medal#portal`, SDK ≥ 1.8.0). `requireMedal()`
+	* throws `MedalConfigError` for a missing key, and that is left to propagate:
+	* a portal that silently cannot reach Medal is worse than one that fails
+	* visibly.
+	*/
+	function portalClient() {
+		return medal.requireMedal().portal;
+	}
+	const REDACTED = "<session>";
+	/**
+	* How far below the thrown error the scrub follows `cause` and
+	* `AggregateError.errors`. Three is deeper than any chain the SDK or `fetch`
+	* builds (undici wraps one `cause` under `fetch failed`), and a bound is
+	* needed at all because `cause` may point back up the chain: an error that is
+	* its own cause would otherwise recurse until the stack ran out.
+	*/
+	const REDACT_DEPTH = 3;
+	function scrub(text, session, label = REDACTED) {
+		return text.includes(session) ? text.split(session).join(label) : text;
+	}
+	/**
+	* Scrub `message` and `stack` on `error` and on every `Error` hanging off it.
+	*
+	* `cause` and `errors` are followed because a logger prints them: Node's
+	* `util.inspect`, Pino's error serializer and Sentry all walk the cause chain,
+	* so a clean top-level message over an unscrubbed `cause.message` is the same
+	* leak one level down. A string `cause` is rewritten in place for the same
+	* reason; anything else there (a response object, say) is not a string a
+	* logger prints verbatim and is left alone.
+	*/
+	function redactError(error, session, depth, label = REDACTED) {
+		if (error.message.includes(session)) error.message = scrub(error.message, session, label);
+		if (typeof error.stack === "string" && error.stack.includes(session)) error.stack = scrub(error.stack, session, label);
+		if (depth >= REDACT_DEPTH) return;
+		if (error.cause instanceof Error) redactError(error.cause, session, depth + 1, label);
+		else if (typeof error.cause === "string") error.cause = scrub(error.cause, session, label);
+		if (error instanceof AggregateError) {
+			for (const inner of error.errors) if (inner instanceof Error) redactError(inner, session, depth + 1, label);
+		}
+	}
+	/**
+	* Scrub `session` out of whatever was thrown, in place, and hand it back.
+	*
+	* In place rather than re-wrapped: callers up the stack switch on
+	* `instanceof MedalApiError` and read `.status` / `.code`, and a fresh `Error`
+	* would erase all three. `message` and `stack` are the two strings a logger
+	* prints — on the error and, via `redactError`, on its `cause` chain;
+	* `MedalApiError.details` is `readonly` and carries the engine's structured
+	* body, which never echoes a request header.
+	*
+	* A non-`Error` throw that contains the session (a bare string, say) is
+	* REPLACED — there is nothing else on it worth keeping, and nothing safe to
+	* pass on.
+	*/
+	function redactSession(error, session) {
+		return redactSecret(error, {
+			value: session,
+			label: REDACTED
+		});
+	}
+	/** `redactSession` for any secret: the Vipps grant, the token it buys, the API key. */
+	function redactSecret(error, secret) {
+		if (secret.value === "") return error;
+		if (error instanceof Error) {
+			redactError(error, secret.value, 0, secret.label);
+			return error;
+		}
+		if (typeof error === "string" && error.includes(secret.value)) return new Error(scrub(error, secret.value, secret.label));
+		return error;
+	}
+	function isDeadSession(error) {
+		return error instanceof MedalApiError && error.status === 401 && (error.code === "PORTAL_SESSION_REQUIRED" || error.code === "PORTAL_SESSION_INVALID");
+	}
+	function isThrottled(error) {
+		return error instanceof MedalApiError && error.status === 429;
+	}
+	/**
+	* Run one session-bound SDK call with the two guarantees from the module
+	* comment, plus the one mapping every such call shares: a 401 that names the
+	* session becomes `PortalSessionExpiredError`. Everything else is rethrown
+	* redacted, for the caller to interpret or for the action's error handler to
+	* turn into «something went wrong».
+	*/
+	async function withSession(session, call) {
+		try {
+			return await call(portalClient());
+		} catch (error) {
+			const scrubbed = redactSession(error, session);
+			if (isDeadSession(scrubbed)) throw new PortalSessionExpiredError();
+			throw scrubbed;
+		}
+	}
+	/**
+	* Ask Medal to e-mail a one-time code.
+	*
+	* Resolves on «sent» and says nothing about whether the address is known —
+	* that is Medal's silence to keep, and the action above this keeps it too. A
+	* 429 is the one answer translated (`PortalThrottledError`); anything else is
+	* rethrown as-is, because a login page that cannot reach Medal should say so.
+	*/
+	async function startLogin(email, locale = "no") {
+		try {
+			unwrap(await portalClient().login.start({
+				email,
+				locale
+			}), "/api/v1/portal/login/start");
+		} catch (error) {
+			if (isThrottled(error)) throw new PortalThrottledError();
+			throw error;
+		}
+	}
+	/**
+	* Exchange the code for a session. `null` for a wrong or expired code — that
+	* is an answer for the form, not a failure — and the token plus Medal's own
+	* expiry on success. The contact summary that rides along is dropped here:
+	* the page fetches the profile with the session it has just been given, and
+	* a second copy of the parent's name has no reader.
+	*/
+	async function verifyLogin(email, code) {
+		try {
+			const session = unwrap(await portalClient().login.verify({
+				email,
+				code
+			}), "/api/v1/portal/login/verify");
+			return {
+				sessionToken: session.session_token,
+				expiresAt: session.expires_at
+			};
+		} catch (error) {
+			if (error instanceof MedalApiError && error.status === 401 && error.code === "PORTAL_CODE_INVALID") return null;
+			if (isThrottled(error)) throw new PortalThrottledError();
+			throw error;
+		}
+	}
+	/**
+	* Revoke the session upstream. A 401 of any flavour is swallowed: it means
+	* Medal no longer honours this token, which is exactly the state a logout is
+	* trying to reach. A 5xx is NOT — the token may still be live, and the caller
+	* decides whether to clear the cookie anyway (it should: a cookie that stays
+	* in the jar is a cookie that stays stealable).
+	*/
+	async function logout(session) {
+		try {
+			await withSession(session, (portal) => portal.logout(session));
+		} catch (error) {
+			if (error instanceof PortalSessionExpiredError) return;
+			if (error instanceof MedalApiError && error.status === 401) return;
+			throw error;
+		}
+	}
+	async function getMe(session) {
+		const profile = await withSession(session, async (portal) => unwrap(await portal.me(session), "/api/v1/portal/me"));
+		return toPortalProfileDto(profile);
+	}
+	/**
+	* The engine names the code `VALIDATION_ERROR` whether it answers 400 or 422
+	* (`medal-client.ts` records that the booking routes see the latter), so the
+	* match is on the code alone. The message has already been through
+	* `redactSession` by the time it is re-thrown here — it is bound for a form.
+	*/
+	async function updateMe(session, patch) {
+		try {
+			const profile = await withSession(session, async (portal) => unwrap(await portal.updateMe(session, patch), "/api/v1/portal/me"));
+			return toPortalProfileDto(profile);
+		} catch (error) {
+			if (error instanceof MedalApiError && error.code === "VALIDATION_ERROR") throw new PortalValidationError(error.message);
+			throw error;
+		}
+	}
+	async function getMyBookings(session) {
+		const bookings = await withSession(session, async (portal) => unwrap(await portal.myBookings(session), "/api/v1/portal/bookings"));
+		return {
+			upcoming: bookings.upcoming.map(toPortalBookingDto),
+			past: bookings.past.map(toPortalBookingDto)
+		};
+	}
+	/**
+	* The parent's own data, as Medal exports it — snake_case and all, because
+	* this is THEIR file (the GDPR right of access) and a projection would be
+	* this site editorialising it. One thing is taken out: every `manage_token`
+	* is nulled. A download sits in a Downloads folder, gets attached to an
+	* e-mail, gets synced to a phone; a live credential for moving an appointment
+	* does not belong in any of those places, and the same bookings are managed
+	* from the page with the session instead.
+	*
+	* Copies rather than mutates: the SDK's object is nobody else's, today, but a
+	* function that quietly edits its input is a bug waiting for a second reader.
+	*/
+	async function exportMyData(session) {
+		const exported = await withSession(session, async (portal) => unwrap(await portal.exportMyData(session), "/api/v1/portal/export"));
+		return {
+			...exported,
+			bookings: exported.bookings.map((booking) => ({
+				...booking,
+				manage_token: null
+			}))
+		};
+	}
+	async function deleteMe(session) {
+		await withSession(session, (portal) => portal.deleteMe(session));
+	}
+	/** Long enough for Medal to round-trip Vipps; short enough that a parent
+	* whose click went nowhere is told so before they give up on the page. */
+	const VIPPS_TIMEOUT_MS = 15e3;
+	/** The SDK's portal namespace on a client with the `VIPPS_TIMEOUT_MS` deadline. */
+	function quickPortal() {
+		return medal.requireMedalWithTimeout(VIPPS_TIMEOUT_MS).portal;
+	}
+	/** `body[key]`, or `undefined` for a body that is not an object. */
+	function field(body, key) {
+		return body && typeof body === "object" ? body[key] : void 0;
+	}
+	/** The `code` of a standard error envelope; `UNKNOWN_ERROR` for anything else. */
+	function vippsErrorCode(body) {
+		const code = field(field(body, "error"), "code");
+		return typeof code === "string" && code !== "" ? code : "UNKNOWN_ERROR";
+	}
+	/** The engine's own 404s on the persons routes; any other 404 is a missing route. */
+	const DOMAIN_NOT_FOUND = /* @__PURE__ */ new Set(["Person not found", "Resource not found"]);
+	function isDomainNotFound(message) {
+		return typeof message === "string" && DOMAIN_NOT_FOUND.has(message);
+	}
+	/** A 2xx whose body is not the shape the contract promises is not a success. */
+	function malformed(path) {
+		return new MedalApiError(200, "NON_JSON_BODY", `Medal returned a malformed body from ${path}`);
+	}
+	/**
+	* `POST` one Vipps route with the API key. Resolves with the `data` member
+	* of the parsed 2xx envelope; throws `MedalApiError` for anything else, with
+	* a message that names the status and the code and NOT the response text —
+	* the only strings Medal echoes on these routes are ones this site sent it.
+	*/
+	async function postVipps(path, body) {
+		return callMedal(path, {
+			method: "POST",
+			body
+		});
+	}
+	/**
+	* One raw request to Medal with the API key — and, for the routes that act as
+	* the parent, their session in `x-portal-session`, the header the SDK's own
+	* portal methods use. `postVipps` is this with `POST` and no session.
+	*
+	* A 204 resolves `undefined`; any other 2xx has to carry the `data` member.
+	*/
+	async function callMedal(path, { method, body, session }) {
+		const { key, base } = medal.requireMedalConfig();
+		const response = await fetch(new URL(path, base).toString(), {
+			method,
+			headers: {
+				authorization: `Bearer ${key}`,
+				/* v8 ignore next -- defensive: no caller sends a request without a body */
+				...body === void 0 ? {} : { "content-type": "application/json" },
+				accept: "application/json",
+				...session === void 0 ? {} : { "x-portal-session": session }
+			},
+			/* v8 ignore next -- defensive: no caller sends a request without a body */
+			...body === void 0 ? {} : { body: JSON.stringify(body) },
+			signal: AbortSignal.timeout(VIPPS_TIMEOUT_MS)
+		});
+		if (response.status === 204) return void 0;
+		const text = await response.text();
+		let parsed;
+		try {
+			parsed = text ? JSON.parse(text) : void 0;
+		} catch {
+			parsed = void 0;
+		}
+		if (!response.ok) {
+			const code = vippsErrorCode(parsed);
+			throw new MedalApiError(response.status, code, `Medal answered ${response.status} ${code} from ${path}`, { domainNotFound: isDomainNotFound(field(field(parsed, "error"), "message")) });
+		}
+		const data = field(parsed, "data");
+		if (data === void 0) throw malformed(path);
+		return data;
+	}
+	/** Run `call`, scrubbing every secret in `secrets` out of whatever it throws. */
+	async function withVippsSecrets(secrets, call) {
+		try {
+			return await call();
+		} catch (error) {
+			let scrubbed = error;
+			for (const secret of secrets()) scrubbed = redactSecret(scrubbed, secret);
+			throw scrubbed;
+		}
+	}
+	function apiKeySecret() {
+		try {
+			return [{
+				value: medal.requireMedalConfig().key,
+				label: "<key>"
+			}];
+		} catch {
+			return [];
+		}
+	}
+	/** The start route's three decisions, by code (and 429 by status); anything else is rethrown. */
+	function mapStartError(error) {
+		if (error instanceof MedalApiError) {
+			if (error.code === "VIPPS_NOT_CONFIGURED") throw new PortalVippsUnavailableError();
+			if (error.code === "INVALID_RETURN_URL") throw new PortalValidationError(error.message);
+			if (error.status === 429) throw new PortalThrottledError();
+		}
+		throw error;
+	}
+	/**
+	* Ask Medal where to send the parent to log in with Vipps.
+	*
+	* `returnUrl` is the absolute address of this site's `/min-side/vipps` route,
+	* which is where Vipps — via Medal — sends the browser back with either a
+	* grant or a reason. Medal checks it against the workspace's site and answers
+	* 400 `INVALID_RETURN_URL` for one it does not recognise; that surfaces as
+	* `PortalValidationError` because it is a configuration mistake on one side
+	* or the other, not something the parent did. 503 `VIPPS_NOT_CONFIGURED`
+	* means the workspace has no Vipps credentials and becomes
+	* `PortalVippsUnavailableError`, which the login page turns into «use e-mail
+	* instead». The address Medal hands back is checked to be HTTPS before anyone
+	* is redirected to it.
+	*/
+	async function startVippsLogin({ returnUrl, browserBinding, locale = "no" }) {
+		const path = "/api/v1/portal/vipps/start";
+		const secrets = () => [...browserBinding ? [{
+			value: browserBinding,
+			label: "<binding>"
+		}] : [], ...apiKeySecret()];
+		return withVippsSecrets(secrets, async () => {
+			const authorizeUrl = field(await postVipps(path, {
+				return_url: returnUrl,
+				...browserBinding ? { browser_binding: browserBinding } : {},
+				locale
+			}).catch(mapStartError), "authorize_url");
+			if (typeof authorizeUrl !== "string" || !authorizeUrl.startsWith("https://")) throw malformed(path);
+			return { authorizeUrl };
+		});
+	}
+	/**
+	* Swap the grant Vipps sent the parent back with for a session. `null` when
+	* Medal does not know it (404 `GRANT_NOT_FOUND` — used already, expired, or
+	* minted for another workspace; the three are not distinguished, and none is
+	* a failure) and the token plus expiry otherwise, in the same shape
+	* `verifyLogin` returns so the route that receives it writes the cookie the
+	* same way.
+	*
+	* The grant and, once known, the token are scrubbed from anything thrown:
+	* the grant is in the request body, the token in the response, and a `fetch`
+	* failure or a serialiser can quote either.
+	*/
+	async function exchangeVippsGrant(grant) {
+		const path = "/api/v1/portal/vipps/exchange";
+		let token = "";
+		const secrets = () => [
+			{
+				value: grant,
+				label: "<grant>"
+			},
+			{
+				value: token,
+				label: REDACTED
+			},
+			...apiKeySecret()
+		];
+		return withVippsSecrets(secrets, async () => {
+			let data;
+			try {
+				data = unwrap(await quickPortal().login.vipps.exchange({ grant }), path);
+			} catch (error) {
+				if (error instanceof MedalApiError && error.code === "GRANT_NOT_FOUND") return null;
+				if (isThrottled(error)) throw new PortalThrottledError();
+				throw error;
+			}
+			const sessionToken = field(data, "session_token");
+			const expiresAt = field(data, "expires_at");
+			if (typeof sessionToken === "string") token = sessionToken;
+			if (token === "" || typeof expiresAt !== "number") throw malformed(path);
+			return {
+				sessionToken: token,
+				expiresAt
+			};
+		});
+	}
+	const PERSONS_PATH = "/api/v1/portal/me/persons";
+	/**
+	* A 404 that is not the engine's own «Person not found» / «Resource not
+	* found». The SDK keeps the engine's sentence as `message`; the raw
+	* `callMedal` drops it and records the verdict in `details.domainNotFound`.
+	*/
+	function isMissingRoute(error) {
+		if (!(error instanceof MedalApiError) || error.status !== 404) return false;
+		const domain = error.details?.domainNotFound === true || isDomainNotFound(error.message);
+		return !(error.code === "NOT_FOUND" && domain);
+	}
+	/** The editor's copy for what the engine refused. Never the engine's own
+	* sentence: it is written for integrators and names wire fields. */
+	function mapPersonError(error) {
+		if (error instanceof MedalApiError) {
+			if (error.code === "CONFLICT") throw new PortalValidationError(messages.duplicateChild);
+			if (error.code === "VALIDATION_ERROR" || error.code === "INVALID_INPUT") throw new PortalValidationError(messages.invalidChild);
+			if (error.status === 404) throw new PortalValidationError(messages.childNotFound);
+			if (error.status === 429) throw new PortalThrottledError();
+		}
+		throw error;
+	}
+	function personPatch(input) {
+		const body = {};
+		if (input.name !== void 0) body.name = input.name;
+		if (input.birthYear !== void 0) body.birth_year = input.birthYear;
+		if (input.birthMonth !== void 0) body.birth_month = input.birthMonth;
+		if (input.notes !== void 0) body.notes = input.notes;
+		if (input.preferredResourceId !== void 0) body.preferred_resource_id = input.preferredResourceId;
+		return body;
+	}
+	/**
+	* On create an absent key and `null` mean the same — nothing — and the
+	* create schema is STRICT about nulls it does not take.
+	*/
+	function personCreate(input) {
+		const body = {
+			name: input.name,
+			birth_year: input.birthYear
+		};
+		if (input.birthMonth != null) body.birth_month = input.birthMonth;
+		if (input.notes != null) body.notes = input.notes;
+		if (input.preferredResourceId != null) body.preferred_resource_id = input.preferredResourceId;
+		return body;
+	}
+	/** Run one persons call with the session scrubbed and a dead one mapped. */
+	async function withPersonsCall(session, call) {
+		return withVippsSecrets(() => [{
+			value: session,
+			label: REDACTED
+		}, ...apiKeySecret()], async () => {
+			try {
+				return await call();
+			} catch (error) {
+				if (isDeadSession(error)) throw new PortalSessionExpiredError();
+				throw error;
+			}
+		});
+	}
+	function wireFamily(profile) {
+		return profile.family.map((member) => ({
+			name: member.name,
+			birth_year: member.birthYear
+		}));
+	}
+	/** The id the refreshed profile gives the child with this name and year. */
+	function idOf(profile, name, birthYear) {
+		const matches = profile.family.filter((member) => member.name === name && member.birthYear === birthYear);
+		return matches.length === 1 ? matches[0].personId : null;
+	}
+	/** Where a child sits in the list the fallback rewrites: by id, else by index. */
+	function familyIndex(profile, target) {
+		if (target.personId) return profile.family.findIndex((member) => member.personId === target.personId);
+		const index = target.index ?? -1;
+		return index >= 0 && index < profile.family.length ? index : -1;
+	}
+	async function createPerson(session, input) {
+		const created = await withPersonsCall(session, async () => {
+			try {
+				const personId = field(unwrap(await quickPortal().persons.create(session, personCreate(input)), PERSONS_PATH), "person_id");
+				return { personId: typeof personId === "string" ? personId : null };
+			} catch (error) {
+				if (isMissingRoute(error)) return null;
+				return mapPersonError(error);
+			}
+		});
+		if (created !== null) return {
+			profile: await getMe(session),
+			personId: created.personId,
+			fallback: false
+		};
+		const profile = await updateMe(session, { family: [...wireFamily(await getMe(session)), {
+			name: input.name,
+			birth_year: input.birthYear
+		}] });
+		return {
+			profile,
+			personId: idOf(profile, input.name, input.birthYear),
+			fallback: true
+		};
+	}
+	async function updatePerson(session, target, patch) {
+		const personId = target.personId ?? null;
+		if (personId !== null) {
+			if (await withPersonsCall(session, async () => {
+				try {
+					await callMedal(`${PERSONS_PATH}/${encodeURIComponent(personId)}`, {
+						method: "PATCH",
+						body: personPatch(patch),
+						session
+					});
+					return true;
+				} catch (error) {
+					if (isMissingRoute(error)) return false;
+					return mapPersonError(error);
+				}
+			})) return {
+				profile: await getMe(session),
+				personId,
+				fallback: false
+			};
+		}
+		const current = await getMe(session);
+		const index = familyIndex(current, target);
+		if (index === -1) mapPersonError(new MedalApiError(404, "NOT_FOUND", "person not in family"));
+		const family = wireFamily(current);
+		const name = patch.name ?? family[index].name;
+		const birthYear = patch.birthYear ?? family[index].birth_year;
+		family[index] = {
+			name,
+			birth_year: birthYear
+		};
+		const profile = await updateMe(session, { family });
+		return {
+			profile,
+			personId: idOf(profile, name, birthYear),
+			fallback: true
+		};
+	}
+	async function removePerson(session, target) {
+		const personId = target.personId ?? null;
+		if (personId !== null) {
+			if (await withPersonsCall(session, async () => {
+				try {
+					await quickPortal().persons.remove(session, personId);
+					return true;
+				} catch (error) {
+					if (isMissingRoute(error)) return false;
+					return mapPersonError(error);
+				}
+			})) return {
+				profile: await getMe(session),
+				personId,
+				fallback: false
+			};
+		}
+		const current = await getMe(session);
+		const index = familyIndex(current, target);
+		if (index === -1) mapPersonError(new MedalApiError(404, "NOT_FOUND", "person not in family"));
+		return {
+			profile: await updateMe(session, { family: wireFamily(current).filter((_, position) => position !== index) }),
+			personId,
+			fallback: true
+		};
+	}
+	/**
+	* Confirm a conflicted Vipps login with the six-digit code Medal e-mailed to
+	* the address on file (SP10 A5): `POST /api/v1/portal/vipps/link/verify`.
+	*
+	* `null` for every refusal Medal folds into 401 `PORTAL_CODE_INVALID` — a
+	* wrong or burned code, an unknown, expired or spent link, a browser binding
+	* that is not the one the login started with — which is one answer for the
+	* form. 409 is `PortalVippsConflictError`, 429 `PortalThrottledError`.
+	*
+	* The link, the code, the binding and the session it buys are all scrubbed
+	* from anything thrown, with the API key. Through the SDK's
+	* `portal.login.vipps.verifyLink`, which sends it exactly once: the right code
+	* consumes the link, so a retry would misreport a completed login.
+	*/
+	async function verifyVippsLink({ link, code, browserBinding }) {
+		const path = "/api/v1/portal/vipps/link/verify";
+		let token = "";
+		const secrets = () => [
+			{
+				value: link,
+				label: "<link>"
+			},
+			{
+				value: code,
+				label: "<code>"
+			},
+			{
+				value: browserBinding,
+				label: "<binding>"
+			},
+			{
+				value: token,
+				label: REDACTED
+			},
+			...apiKeySecret()
+		];
+		return withVippsSecrets(secrets, async () => {
+			let data;
+			try {
+				data = unwrap(await quickPortal().login.vipps.verifyLink({
+					link,
+					code,
+					browser_binding: browserBinding
+				}), path);
+			} catch (error) {
+				return mapLinkError(error);
+			}
+			const sessionToken = field(data, "session_token");
+			const expiresAt = field(data, "expires_at");
+			if (typeof sessionToken === "string") token = sessionToken;
+			if (token === "" || typeof expiresAt !== "number") throw malformed(path);
+			return {
+				sessionToken: token,
+				expiresAt
+			};
+		});
+	}
+	/** The link verify's refusals: `null` for «wrong or expired», the two errors, else rethrown. */
+	function mapLinkError(error) {
+		if (error instanceof MedalApiError) {
+			if (error.status === 401 && error.code === "PORTAL_CODE_INVALID") return null;
+			if (error.status === 409 && error.code === "VIPPS_IDENTITY_CONFLICT") throw new PortalVippsConflictError();
+			if (error.status === 429) throw new PortalThrottledError();
+		}
+		throw error;
+	}
+	const VIPPS_LINK_PATH = "/api/v1/portal/me/vipps/link";
+	/** The session, the binding, the grant when there is one, and the key — scrubbed; a dead session mapped. */
+	async function withVippsLinkCall(session, extra, call) {
+		return withVippsSecrets(() => [
+			{
+				value: session,
+				label: REDACTED
+			},
+			...extra,
+			...apiKeySecret()
+		], async () => {
+			try {
+				return await call();
+			} catch (error) {
+				if (isDeadSession(error)) throw new PortalSessionExpiredError();
+				throw error;
+			}
+		});
+	}
+	function isVippsNotConfigured(error) {
+		return error instanceof MedalApiError && error.code === "VIPPS_NOT_CONFIGURED";
+	}
+	/**
+	* Ask Medal where to send a logged-in parent to link Vipps. `null` against a
+	* Medal without the route AND for a workspace without Vipps (503
+	* `VIPPS_NOT_CONFIGURED`) — both hide the row, with nothing to say.
+	* `PortalThrottledError` for a 429, `PortalSessionExpiredError` for a dead
+	* session; the address is checked to be HTTPS.
+	*/
+	async function startVippsLink(session, { returnUrl, browserBinding, locale = "no" }) {
+		const path = `${VIPPS_LINK_PATH}/start`;
+		return withVippsLinkCall(session, [{
+			value: browserBinding,
+			label: "<binding>"
+		}], async () => {
+			let data;
+			try {
+				data = await callMedal(path, {
+					method: "POST",
+					body: {
+						return_url: returnUrl,
+						browser_binding: browserBinding,
+						locale
+					},
+					session
+				});
+			} catch (error) {
+				if (isMissingRoute(error) || isVippsNotConfigured(error)) return null;
+				if (isDeadSession(error)) throw error;
+				return mapStartError(error);
+			}
+			const authorizeUrl = field(data, "authorize_url");
+			if (typeof authorizeUrl !== "string" || !authorizeUrl.startsWith("https://")) throw malformed(path);
+			return { authorizeUrl };
+		});
+	}
+	/**
+	* Spend the link grant Medal's callback handed back (medal-monorepo #5592).
+	*
+	* 200 `{ data: { status: 'linked', already_linked } }` is `linked` — a 2xx
+	* without that status is malformed, not a success. 409
+	* `VIPPS_IDENTITY_CONFLICT` is `conflict` (this Vipps account belongs to
+	* another profile). 404 `LINK_GRANT_NOT_FOUND` — an unknown, spent, expired
+	* or malformed grant, and (since the #5592 security review, which BURNS the
+	* grant on it) a wrong binding or another customer's session — is `invalid`,
+	* as are a 400 and a non-session 401. Every one of the three is final for
+	* the grant. A dead session and a throttle are the seam's usual errors.
+	*/
+	async function completeVippsLink(session, { grant, browserBinding }) {
+		const path = `${VIPPS_LINK_PATH}/complete`;
+		return withVippsLinkCall(session, [{
+			value: grant,
+			label: "<grant>"
+		}, {
+			value: browserBinding,
+			label: "<binding>"
+		}], async () => {
+			try {
+				if (field(await callMedal(path, {
+					method: "POST",
+					body: {
+						grant,
+						browser_binding: browserBinding
+					},
+					session
+				}), "status") !== "linked") throw malformed(path);
+				return "linked";
+			} catch (error) {
+				return mapCompleteError(error);
+			}
+		});
+	}
+	/** The complete route's refusals, as `VippsLinkCompletion`; anything else is rethrown. */
+	function mapCompleteError(error) {
+		if (!(error instanceof MedalApiError)) throw error;
+		const { status } = error;
+		if (isDeadSession(error)) throw error;
+		if (status === 409) return "conflict";
+		if (status === 400 || status === 401 || status === 404) return "invalid";
+		if (status === 429) throw new PortalThrottledError();
+		throw error;
+	}
+	return {
+		startLogin,
+		verifyLogin,
+		logout,
+		getMe,
+		updateMe,
+		getMyBookings,
+		exportMyData,
+		deleteMe,
+		startVippsLogin,
+		exchangeVippsGrant,
+		createPerson,
+		updatePerson,
+		removePerson,
+		verifyVippsLink,
+		startVippsLink,
+		completeVippsLink
+	};
+}
+//#endregion
+export { PortalSessionExpiredError, PortalThrottledError, PortalValidationError, PortalVippsConflictError, PortalVippsUnavailableError, createPortalSeam };
+
+//# sourceMappingURL=medal-portal.mjs.map