@medalsocial/booking 0.0.0-placeholder.0 → 0.2.0

package/dist/next/routes/shared.mjs

@@ -0,0 +1,162 @@
+import { MedalConfigError } from "../medal.mjs";
+import { MedalApiError } from "@medalsocial/sdk";
+import { NextResponse } from "next/server";
+//#region src/next/routes/shared.ts
+/**
+* What the booking routes are allowed to say to a browser.
+*
+* The wizard reads `error` straight into `WizardState.error`, which is a closed
+* union — `'maxParty' | 'slotTaken' | 'conflict' | 'invalidInput' |
+* 'unconfigured' | 'upstreamError'` — so the spelling here is load-bearing
+* rather than descriptive.
+*
+* `upstreamError` is the catch-all. Something has to be in the field either
+* way, because `NextResponse.json({ error: undefined })` serialises to `{}`
+* and reads as a failure with no reason at all.
+*
+* Only the create route is held to the union. `catalogueErrorResponse` also
+* relays the upstream's own code where there is one, so the read routes can
+* say words the wizard has never heard of — which is safe precisely because
+* nothing is reading them into `WizardState`.
+*
+* `message` appears only when THIS file wrote it. Medal's own error bodies are
+* written for the integrator holding the API key — they name workspaces, ids
+* and internal field paths — and none of that belongs in front of a visitor.
+*/
+function bookingErrorResponse(code, status, message) {
+	return NextResponse.json(message === void 0 ? { error: code } : {
+		error: code,
+		message
+	}, { status });
+}
+/**
+* The catch for the read routes, in one place because it is one behaviour.
+*
+* The upstream *status* is relayed rather than flattened, because it is the
+* part that says what to do — a 404 means this service no longer exists and
+* the wizard should reload the catalogue, a 429 means back off, a 403 means
+* the plan lost the bookings module. The upstream *message* is not.
+*
+* A `MedalApiError` already carries its own explanation on both sides of the
+* wire; a missing API key and an unrecognised throw do not, and those two are
+* logged.
+*/
+function catalogueErrorResponse(rt, error, endpoint) {
+	if (error instanceof MedalConfigError) {
+		rt.logger.error({
+			err: error,
+			endpoint
+		}, "Booking API is not configured");
+		return bookingErrorResponse("unconfigured", 503);
+	}
+	if (error instanceof MedalApiError) return bookingErrorResponse(error.code ?? "upstreamError", error.status);
+	rt.logger.error({
+		err: error,
+		endpoint
+	}, "Unexpected booking API failure");
+	return bookingErrorResponse("upstreamError", 502);
+}
+/** What a service id looks like: Medal's ids are word characters and dashes. */
+const SERVICE_ID_SHAPE = /^[\w-]{1,64}$/;
+/**
+* A `service_id` from the query string, checked before it can reach a cache
+* key or a cache tag: the right shape, and a service the catalogue actually
+* has. Otherwise every invented id would be a Medal call and a cache entry.
+*
+* The catalogue read is the cached one, so a real id costs nothing extra.
+*/
+async function knownServiceId(rt, raw) {
+	if (!SERVICE_ID_SHAPE.test(raw)) return { error: bookingErrorResponse("invalidInput", 400, "service_id is malformed") };
+	let services;
+	try {
+		services = await rt.catalogue.cachedServices();
+	} catch (error) {
+		return { error: catalogueErrorResponse(rt, error, "services") };
+	}
+	if (!services.some((service) => service.id === raw)) return { error: bookingErrorResponse("invalidInput", 400, "Unknown service_id") };
+	return { serviceId: raw };
+}
+/**
+* `extra_service_ids` from the query string — the rest of ONE person's visit
+* after `service_id`, comma-separated, in order. Blank entries are dropped, so
+* an absent, empty or `,`-only value is a one-service visit (`[]`).
+*
+* Held to everything the engine would refuse with a 422 (more than three, one
+* twice, `service_id` again) and to what `knownServiceId` holds `service_id` to
+* (the shape, and a service the catalogue has), for the same reason: every id
+* here lands in a cache key and a cache tag. Call it after `knownServiceId`.
+*/
+async function knownExtraServiceIds(rt, raw, serviceId) {
+	const ids = (raw ?? "").split(",").map((id) => id.trim()).filter((id) => id.length > 0);
+	if (ids.length === 0) return { extraServiceIds: [] };
+	const refuse = (message) => ({ error: bookingErrorResponse("invalidInput", 400, message) });
+	if (ids.length > 3) return refuse(`extra_service_ids must name at most 3 services`);
+	if (new Set(ids).size !== ids.length) return refuse("extra_service_ids names a service twice");
+	if (ids.includes(serviceId)) return refuse("extra_service_ids repeats service_id");
+	if (!ids.every((id) => SERVICE_ID_SHAPE.test(id))) return refuse("extra_service_ids is malformed");
+	let services;
+	try {
+		services = await rt.catalogue.cachedServices();
+	} catch (error) {
+		return { error: catalogueErrorResponse(rt, error, "services") };
+	}
+	const known = new Set(services.map((service) => service.id));
+	if (!ids.every((id) => known.has(id))) return refuse("Unknown service in extra_service_ids");
+	return { extraServiceIds: ids };
+}
+/**
+* The engine's «that slot is no longer free».
+*
+* It arrives as `CONFLICT` with `SLOT_TAKEN` in the message: the SDK exposes no
+* finer code (`MedalApiError.code` is the generic `CONFLICT`, shared with a
+* duplicate key and an unseatable party). The message is read HERE and nowhere
+* else, so the day the engine grows a structured code there is one line to
+* change.
+*/
+function isSlotTaken(error) {
+	return error instanceof MedalApiError && error.code === "CONFLICT" && error.message.includes("SLOT_TAKEN");
+}
+/**
+* 62 days. A bound on what a visitor-controlled query string may ask the site
+* to fetch on their behalf — not the engine's own limit, which clamps rather
+* than refuses. The wizard asks for a week at a time.
+*/
+const MAX_RANGE_MS = 53568e5;
+/**
+* Epoch milliseconds or an ISO 8601 string — the same two forms the engine's
+* own parser accepts, so a bound this site admits is one Medal would have
+* admitted too. `null` for anything it cannot read as a time.
+*/
+function parseTimestamp(raw) {
+	const trimmed = raw?.trim();
+	if (!trimmed) return null;
+	const numeric = Number(trimmed);
+	const timestamp = Number.isFinite(numeric) ? numeric : Date.parse(trimmed);
+	return Number.isFinite(timestamp) ? timestamp : null;
+}
+/**
+* The `from_ts`/`to_ts` pair the read routes take, validated before Medal is
+* called. Every guard answers a request the engine would also refuse, and an
+* unreadable bound would otherwise throw inside the client and surface as an
+* opaque 502 pointing at Medal for a typo in our own query string.
+*/
+function parseRange(searchParams) {
+	const fromTs = parseTimestamp(searchParams.get("from_ts"));
+	const toTs = parseTimestamp(searchParams.get("to_ts"));
+	if (fromTs === null || toTs === null) return { error: bookingErrorResponse("invalidInput", 400, "from_ts and to_ts must be Unix milliseconds or ISO 8601 date-times") };
+	if (toTs <= fromTs) return { error: bookingErrorResponse("invalidInput", 400, "to_ts must be after from_ts") };
+	if (toTs - fromTs > MAX_RANGE_MS) return { error: bookingErrorResponse("invalidInput", 400, "Range must not exceed 62 days") };
+	return {
+		fromTs,
+		toTs
+	};
+}
+/** SHA-256, hex — for idempotency keys that must never carry what they hash. */
+async function digestOf(input) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
+export { bookingErrorResponse, catalogueErrorResponse, digestOf, isSlotTaken, knownExtraServiceIds, knownServiceId, parseRange };
+
+//# sourceMappingURL=shared.mjs.map

package/dist/next/routes/shared.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.mjs","names":[],"sources":["../../../src/next/routes/shared.ts"],"sourcesContent":["/**\n * What the booking routes are allowed to say to a browser.\n *\n * The wizard reads `error` straight into `WizardState.error`, which is a closed\n * union — `'maxParty' | 'slotTaken' | 'conflict' | 'invalidInput' |\n * 'unconfigured' | 'upstreamError'` — so the spelling here is load-bearing\n * rather than descriptive.\n *\n * `upstreamError` is the catch-all. Something has to be in the field either\n * way, because `NextResponse.json({ error: undefined })` serialises to `{}`\n * and reads as a failure with no reason at all.\n *\n * Only the create route is held to the union. `catalogueErrorResponse` also\n * relays the upstream's own code where there is one, so the read routes can\n * say words the wizard has never heard of — which is safe precisely because\n * nothing is reading them into `WizardState`.\n *\n * `message` appears only when THIS file wrote it. Medal's own error bodies are\n * written for the integrator holding the API key — they name workspaces, ids\n * and internal field paths — and none of that belongs in front of a visitor.\n */\n\nimport { MedalApiError } from '@medalsocial/sdk';\nimport { NextResponse } from 'next/server';\nimport { MedalConfigError } from '../medal';\nimport type { BookingRuntime } from '../runtime';\n\nexport function bookingErrorResponse(code: string, status: number, message?: string): NextResponse {\n  return NextResponse.json(message === undefined ? { error: code } : { error: code, message }, {\n    status,\n  });\n}\n\n/**\n * The catch for the read routes, in one place because it is one behaviour.\n *\n * The upstream *status* is relayed rather than flattened, because it is the\n * part that says what to do — a 404 means this service no longer exists and\n * the wizard should reload the catalogue, a 429 means back off, a 403 means\n * the plan lost the bookings module. The upstream *message* is not.\n *\n * A `MedalApiError` already carries its own explanation on both sides of the\n * wire; a missing API key and an unrecognised throw do not, and those two are\n * logged.\n */\nexport function catalogueErrorResponse(\n  rt: Pick<BookingRuntime, 'logger'>,\n  error: unknown,\n  endpoint: string\n): NextResponse {\n  if (error instanceof MedalConfigError) {\n    rt.logger.error({ err: error, endpoint }, 'Booking API is not configured');\n    return bookingErrorResponse('unconfigured', 503);\n  }\n  if (error instanceof MedalApiError) {\n    return bookingErrorResponse(error.code ?? 'upstreamError', error.status);\n  }\n  rt.logger.error({ err: error, endpoint }, 'Unexpected booking API failure');\n  return bookingErrorResponse('upstreamError', 502);\n}\n\n/** What a service id looks like: Medal's ids are word characters and dashes. */\nconst SERVICE_ID_SHAPE = /^[\\w-]{1,64}$/;\n\n/**\n * A `service_id` from the query string, checked before it can reach a cache\n * key or a cache tag: the right shape, and a service the catalogue actually\n * has. Otherwise every invented id would be a Medal call and a cache entry.\n *\n * The catalogue read is the cached one, so a real id costs nothing extra.\n */\nexport async function knownServiceId(\n  rt: Pick<BookingRuntime, 'logger' | 'catalogue'>,\n  raw: string\n): Promise<{ serviceId: string } | { error: NextResponse }> {\n  if (!SERVICE_ID_SHAPE.test(raw)) {\n    return { error: bookingErrorResponse('invalidInput', 400, 'service_id is malformed') };\n  }\n  let services: Array<{ id: string }>;\n  try {\n    services = await rt.catalogue.cachedServices();\n  } catch (error) {\n    return { error: catalogueErrorResponse(rt, error, 'services') };\n  }\n  if (!services.some((service) => service.id === raw)) {\n    return { error: bookingErrorResponse('invalidInput', 400, 'Unknown service_id') };\n  }\n  return { serviceId: raw };\n}\n\n/**\n * How many services one person's visit may add after the first — the engine's\n * own bound (four services in all), refused here so a visitor's query string\n * cannot make it a Medal call.\n */\nexport const MAX_EXTRA_SERVICES = 3;\n\n/**\n * `extra_service_ids` from the query string — the rest of ONE person's visit\n * after `service_id`, comma-separated, in order. Blank entries are dropped, so\n * an absent, empty or `,`-only value is a one-service visit (`[]`).\n *\n * Held to everything the engine would refuse with a 422 (more than three, one\n * twice, `service_id` again) and to what `knownServiceId` holds `service_id` to\n * (the shape, and a service the catalogue has), for the same reason: every id\n * here lands in a cache key and a cache tag. Call it after `knownServiceId`.\n */\nexport async function knownExtraServiceIds(\n  rt: Pick<BookingRuntime, 'logger' | 'catalogue'>,\n  raw: string | null,\n  serviceId: string\n): Promise<{ extraServiceIds: string[] } | { error: NextResponse }> {\n  const ids = (raw ?? '')\n    .split(',')\n    .map((id) => id.trim())\n    .filter((id) => id.length > 0);\n  if (ids.length === 0) return { extraServiceIds: [] };\n  const refuse = (message: string) => ({\n    error: bookingErrorResponse('invalidInput', 400, message),\n  });\n  if (ids.length > MAX_EXTRA_SERVICES) {\n    return refuse(`extra_service_ids must name at most ${MAX_EXTRA_SERVICES} services`);\n  }\n  if (new Set(ids).size !== ids.length) return refuse('extra_service_ids names a service twice');\n  if (ids.includes(serviceId)) return refuse('extra_service_ids repeats service_id');\n  if (!ids.every((id) => SERVICE_ID_SHAPE.test(id))) {\n    return refuse('extra_service_ids is malformed');\n  }\n  let services: Array<{ id: string }>;\n  try {\n    services = await rt.catalogue.cachedServices();\n  } catch (error) {\n    return { error: catalogueErrorResponse(rt, error, 'services') };\n  }\n  const known = new Set(services.map((service) => service.id));\n  if (!ids.every((id) => known.has(id))) return refuse('Unknown service in extra_service_ids');\n  return { extraServiceIds: ids };\n}\n\n/**\n * The engine's «that slot is no longer free».\n *\n * It arrives as `CONFLICT` with `SLOT_TAKEN` in the message: the SDK exposes no\n * finer code (`MedalApiError.code` is the generic `CONFLICT`, shared with a\n * duplicate key and an unseatable party). The message is read HERE and nowhere\n * else, so the day the engine grows a structured code there is one line to\n * change.\n */\nexport function isSlotTaken(error: unknown): boolean {\n  return (\n    error instanceof MedalApiError &&\n    error.code === 'CONFLICT' &&\n    error.message.includes('SLOT_TAKEN')\n  );\n}\n\n/**\n * 62 days. A bound on what a visitor-controlled query string may ask the site\n * to fetch on their behalf — not the engine's own limit, which clamps rather\n * than refuses. The wizard asks for a week at a time.\n */\nconst MAX_RANGE_MS = 62 * 24 * 60 * 60 * 1000;\n\n/**\n * Epoch milliseconds or an ISO 8601 string — the same two forms the engine's\n * own parser accepts, so a bound this site admits is one Medal would have\n * admitted too. `null` for anything it cannot read as a time.\n */\nfunction parseTimestamp(raw: string | null): number | null {\n  const trimmed = raw?.trim();\n  if (!trimmed) return null;\n  const numeric = Number(trimmed);\n  const timestamp = Number.isFinite(numeric) ? numeric : Date.parse(trimmed);\n  return Number.isFinite(timestamp) ? timestamp : null;\n}\n\n/**\n * The `from_ts`/`to_ts` pair the read routes take, validated before Medal is\n * called. Every guard answers a request the engine would also refuse, and an\n * unreadable bound would otherwise throw inside the client and surface as an\n * opaque 502 pointing at Medal for a typo in our own query string.\n */\nexport function parseRange(\n  searchParams: URLSearchParams\n): { fromTs: number; toTs: number } | { error: NextResponse } {\n  const fromTs = parseTimestamp(searchParams.get('from_ts'));\n  const toTs = parseTimestamp(searchParams.get('to_ts'));\n  if (fromTs === null || toTs === null) {\n    return {\n      error: bookingErrorResponse(\n        'invalidInput',\n        400,\n        'from_ts and to_ts must be Unix milliseconds or ISO 8601 date-times'\n      ),\n    };\n  }\n  if (toTs <= fromTs) {\n    return { error: bookingErrorResponse('invalidInput', 400, 'to_ts must be after from_ts') };\n  }\n  if (toTs - fromTs > MAX_RANGE_MS) {\n    return { error: bookingErrorResponse('invalidInput', 400, 'Range must not exceed 62 days') };\n  }\n  return { fromTs, toTs };\n}\n\n/** SHA-256, hex — for idempotency keys that must never carry what they hash. */\nexport async function digestOf(input: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));\n  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,qBAAqB,MAAc,QAAgB,SAAgC;CACjG,OAAO,aAAa,KAAK,YAAY,KAAA,IAAY,EAAE,OAAO,KAAK,IAAI;EAAE,OAAO;EAAM;CAAQ,GAAG,EAC3F,OACF,CAAC;AACH;;;;;;;;;;;;;AAcA,SAAgB,uBACd,IACA,OACA,UACc;CACd,IAAI,iBAAiB,kBAAkB;EACrC,GAAG,OAAO,MAAM;GAAE,KAAK;GAAO;EAAS,GAAG,+BAA+B;EACzE,OAAO,qBAAqB,gBAAgB,GAAG;CACjD;CACA,IAAI,iBAAiB,eACnB,OAAO,qBAAqB,MAAM,QAAQ,iBAAiB,MAAM,MAAM;CAEzE,GAAG,OAAO,MAAM;EAAE,KAAK;EAAO;CAAS,GAAG,gCAAgC;CAC1E,OAAO,qBAAqB,iBAAiB,GAAG;AAClD;;AAGA,MAAM,mBAAmB;;;;;;;;AASzB,eAAsB,eACpB,IACA,KAC0D;CAC1D,IAAI,CAAC,iBAAiB,KAAK,GAAG,GAC5B,OAAO,EAAE,OAAO,qBAAqB,gBAAgB,KAAK,yBAAyB,EAAE;CAEvF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,GAAG,UAAU,eAAe;CAC/C,SAAS,OAAO;EACd,OAAO,EAAE,OAAO,uBAAuB,IAAI,OAAO,UAAU,EAAE;CAChE;CACA,IAAI,CAAC,SAAS,MAAM,YAAY,QAAQ,OAAO,GAAG,GAChD,OAAO,EAAE,OAAO,qBAAqB,gBAAgB,KAAK,oBAAoB,EAAE;CAElF,OAAO,EAAE,WAAW,IAAI;AAC1B;;;;;;;;;;;AAmBA,eAAsB,qBACpB,IACA,KACA,WACkE;CAClE,MAAM,OAAO,OAAO,GAAA,CACjB,MAAM,GAAG,CAAC,CACV,KAAK,OAAO,GAAG,KAAK,CAAC,CAAC,CACtB,QAAQ,OAAO,GAAG,SAAS,CAAC;CAC/B,IAAI,IAAI,WAAW,GAAG,OAAO,EAAE,iBAAiB,CAAC,EAAE;CACnD,MAAM,UAAU,aAAqB,EACnC,OAAO,qBAAqB,gBAAgB,KAAK,OAAO,EAC1D;CACA,IAAI,IAAI,SAAA,GACN,OAAO,OAAO,gDAAoE;CAEpF,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,QAAQ,OAAO,OAAO,yCAAyC;CAC7F,IAAI,IAAI,SAAS,SAAS,GAAG,OAAO,OAAO,sCAAsC;CACjF,IAAI,CAAC,IAAI,OAAO,OAAO,iBAAiB,KAAK,EAAE,CAAC,GAC9C,OAAO,OAAO,gCAAgC;CAEhD,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,GAAG,UAAU,eAAe;CAC/C,SAAS,OAAO;EACd,OAAO,EAAE,OAAO,uBAAuB,IAAI,OAAO,UAAU,EAAE;CAChE;CACA,MAAM,QAAQ,IAAI,IAAI,SAAS,KAAK,YAAY,QAAQ,EAAE,CAAC;CAC3D,IAAI,CAAC,IAAI,OAAO,OAAO,MAAM,IAAI,EAAE,CAAC,GAAG,OAAO,OAAO,sCAAsC;CAC3F,OAAO,EAAE,iBAAiB,IAAI;AAChC;;;;;;;;;;AAWA,SAAgB,YAAY,OAAyB;CACnD,OACE,iBAAiB,iBACjB,MAAM,SAAS,cACf,MAAM,QAAQ,SAAS,YAAY;AAEvC;;;;;;AAOA,MAAM,eAAe;;;;;;AAOrB,SAAS,eAAe,KAAmC;CACzD,MAAM,UAAU,KAAK,KAAK;CAC1B,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,UAAU,OAAO,OAAO;CAC9B,MAAM,YAAY,OAAO,SAAS,OAAO,IAAI,UAAU,KAAK,MAAM,OAAO;CACzE,OAAO,OAAO,SAAS,SAAS,IAAI,YAAY;AAClD;;;;;;;AAQA,SAAgB,WACd,cAC4D;CAC5D,MAAM,SAAS,eAAe,aAAa,IAAI,SAAS,CAAC;CACzD,MAAM,OAAO,eAAe,aAAa,IAAI,OAAO,CAAC;CACrD,IAAI,WAAW,QAAQ,SAAS,MAC9B,OAAO,EACL,OAAO,qBACL,gBACA,KACA,oEACF,EACF;CAEF,IAAI,QAAQ,QACV,OAAO,EAAE,OAAO,qBAAqB,gBAAgB,KAAK,6BAA6B,EAAE;CAE3F,IAAI,OAAO,SAAS,cAClB,OAAO,EAAE,OAAO,qBAAqB,gBAAgB,KAAK,+BAA+B,EAAE;CAE7F,OAAO;EAAE;EAAQ;CAAK;AACxB;;AAGA,eAAsB,SAAS,OAAgC;CAC7D,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC;CACpF,OAAO,MAAM,KAAK,IAAI,WAAW,MAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AACjG"}

package/dist/next/routes/vipps-return.mjs

@@ -0,0 +1,166 @@
+import { isVippsToken } from "../../core/portal/vipps-link.mjs";
+import { VIPPS_CONFIRM_QUERY, maskedAddress } from "../../core/portal/vipps-return.mjs";
+import { PortalSessionExpiredError, PortalThrottledError } from "../portal/medal-portal.mjs";
+import { NextResponse } from "next/server";
+//#region src/next/routes/vipps-return.ts
+/**
+* The two addresses Vipps (through Medal) sends a browser back to. Route
+* handlers and not pages: only an action or a route handler may write a
+* cookie, and a page cannot. They return NO body, so nothing a third party
+* wrote into the query string can be echoed into HTML, and the only thing
+* they do with a query value is compare it to a constant. Redirect targets
+* are built on the request's own origin.
+*/
+/** Whether the portal is on for this request (the site's switch, else the config). */
+async function portalEnabled(rt) {
+	if (rt.paths.portal === null) return false;
+	const enabled = rt.options.portal?.enabled;
+	return enabled ? enabled() : rt.config.portal.enabled;
+}
+function seeOther(path, request, headers = {}) {
+	const location = new URL(path, request.url);
+	return new NextResponse(null, {
+		status: 303,
+		headers: {
+			Location: location.toString(),
+			"Cache-Control": "no-store",
+			...headers
+		}
+	});
+}
+const VIPPS_LOGIN_QUERY = "vipps";
+/**
+* `GET <vippsReturnPath>` — where Vipps sends the parent back, and the one
+* place a Vipps grant becomes a session cookie.
+*
+* Medal lands the browser here with exactly one of: `?grant=<opaque>` (a
+* session is waiting), `?vipps=cancelled`, `?vipps=needs_email_login` (more
+* than one profile, log in with e-mail to pick one), `?vipps=confirm_email`
+* (one plausible profile, a code is on its way) or `?vipps=failed`.
+*
+* The cookie is written on ONE branch: a grant Medal accepted, arriving in
+* the browser that started the login (it holds the binding cookie). A grant
+* in any other browser is never exchanged. That, a grant Medal refused, or an
+* exchange that could not be made at all goes to the login with
+* `?vipps=failed` and the e-mail form; so does anything unrecognised.
+*
+* WHERE THE PARENT LANDS is the portal unless a login that started somewhere
+* else said otherwise; that destination travels in a read-once httpOnly
+* cookie (`core/portal/next-path.ts`), re-validated on the way out, and it is
+* taken on EVERY branch.
+*/
+async function vippsReturnRoute(rt, request) {
+	if (!await portalEnabled(rt)) return seeOther("/", request);
+	const portalPath = rt.paths.portal;
+	const login = rt.paths.portalLogin;
+	const loginWith = (outcome) => `${login}?${VIPPS_LOGIN_QUERY}=${outcome}`;
+	const { searchParams } = new URL(request.url);
+	const grant = searchParams.get("grant");
+	const next = await rt.nextPath.takePortalNextPath();
+	if (grant) {
+		if (await rt.vippsLink.readBrowserBinding() === null) {
+			rt.logger.warn({}, "Vipps grant arrived without this browser’s login binding");
+			return seeOther(next ?? loginWith("failed"), request);
+		}
+		await rt.vippsLink.clearBrowserBinding();
+		let session;
+		try {
+			session = await rt.portal.exchangeVippsGrant(grant);
+		} catch (error) {
+			rt.logger.error({ err: error }, "Vipps grant could not be exchanged");
+			return seeOther(next ?? loginWith("failed"), request);
+		}
+		if (session === null) return seeOther(next ?? loginWith("failed"), request);
+		await rt.session.writePortalSession(session.sessionToken, session.expiresAt);
+		return seeOther(next ?? portalPath, request);
+	}
+	if (searchParams.get(VIPPS_LOGIN_QUERY) === "confirm_email") {
+		const link = searchParams.getAll("link");
+		if (link.length !== 1 || !isVippsToken(link[0]) || await rt.vippsLink.readBrowserBinding() === null) return seeOther(next ?? loginWith("failed"), request);
+		await rt.vippsLink.writePendingLink(link[0]);
+		const target = new URL(next ?? login, request.url);
+		target.searchParams.set(VIPPS_LOGIN_QUERY, VIPPS_CONFIRM_QUERY);
+		const to = maskedAddress(searchParams.get("to"));
+		if (to !== null) target.searchParams.set("to", to);
+		return seeOther(`${target.pathname}${target.search}`, request);
+	}
+	if (next !== null) return seeOther(next, request);
+	switch (searchParams.get(VIPPS_LOGIN_QUERY)) {
+		case "cancelled": return seeOther(login, request);
+		case "needs_email_login": return seeOther(loginWith("needs_email_login"), request);
+		default: return seeOther(loginWith("failed"), request);
+	}
+}
+const GRANT_KEY = "link_grant";
+const MARKER_KEY = "vipps";
+/**
+* What a bare marker may say: a sentence at most. `linked` without a grant is
+* not proof of anything and says nothing; `cancelled` says nothing either.
+*/
+function markerFlash(value) {
+	if (value === "linked" || value === "cancelled") return null;
+	if (value === "link_conflict") return "link_conflict";
+	return "link_failed";
+}
+/**
+* `GET <vippsLinkReturnPath>` — where Vipps, via Medal, sends a LOGGED-IN
+* parent back from «link Vipps» on the profile.
+*
+* `?link_grant=<43 chars>` is a one-time link grant this handler spends with
+* the parent's session and this browser's binding; `?vipps=link_conflict`,
+* `cancelled` or `failed` are bare markers.
+*
+* NOTHING IN THE QUERY IS TRUSTED AS AN OUTCOME, AND NOTHING STAYS IN IT.
+* Every answer is a 303 to a bare portal URL with `Referrer-Policy:
+* no-referrer`; the outcome travels as an httpOnly flash cookie, and `linked`
+* is written ONLY after Medal accepted a grant this handler exchanged.
+*
+* The binding is spent once Medal has answered about an exchanged grant. A
+* navigation without a grant, a malformed grant, a throttle or an outage
+* leave it to expire on its own. A session Medal no longer honours is cleared
+* here and the parent goes to the login.
+*/
+async function vippsLinkReturnRoute(rt, request) {
+	const noReferrer = { "Referrer-Policy": "no-referrer" };
+	if (!await portalEnabled(rt)) return seeOther("/", request, noReferrer);
+	const portalPath = rt.paths.portal;
+	const session = await rt.session.readPortalSession();
+	if (session === null) return seeOther(rt.paths.portalLogin, request, noReferrer);
+	const landWith = async (flash) => {
+		if (flash !== null) await rt.flash.writeVippsLinkFlash(flash);
+		return seeOther(portalPath, request, noReferrer);
+	};
+	const { searchParams } = new URL(request.url);
+	const grants = searchParams.getAll(GRANT_KEY);
+	if (grants.length > 0) {
+		const flash = await spendGrant(rt, session, grants);
+		if (flash === "session") return seeOther(rt.paths.portalLogin, request, noReferrer);
+		return landWith(flash);
+	}
+	return landWith(markerFlash(searchParams.get(MARKER_KEY)));
+}
+/** Spend one well-formed grant with this browser's binding; what the profile should say. */
+async function spendGrant(rt, session, grants) {
+	const binding = await rt.vippsLink.readBrowserBinding();
+	if (grants.length !== 1 || !isVippsToken(grants[0]) || binding === null) return "link_failed";
+	try {
+		const outcome = await rt.portal.completeVippsLink(session, {
+			grant: grants[0],
+			browserBinding: binding
+		});
+		await rt.vippsLink.clearBrowserBinding();
+		if (outcome === "linked") return "linked";
+		return outcome === "conflict" ? "link_conflict" : "link_failed";
+	} catch (error) {
+		if (error instanceof PortalSessionExpiredError) {
+			await rt.session.clearPortalSession();
+			return "session";
+		}
+		if (!(error instanceof PortalThrottledError)) rt.logger.error({ err: error }, "Vipps link grant could not be completed");
+		return "link_failed";
+	}
+}
+//#endregion
+export { portalEnabled, vippsLinkReturnRoute, vippsReturnRoute };
+
+//# sourceMappingURL=vipps-return.mjs.map

package/dist/next/routes/vipps-return.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vipps-return.mjs","names":[],"sources":["../../../src/next/routes/vipps-return.ts"],"sourcesContent":["/**\n * The two addresses Vipps (through Medal) sends a browser back to. Route\n * handlers and not pages: only an action or a route handler may write a\n * cookie, and a page cannot. They return NO body, so nothing a third party\n * wrote into the query string can be echoed into HTML, and the only thing\n * they do with a query value is compare it to a constant. Redirect targets\n * are built on the request's own origin.\n */\n\nimport { NextResponse } from 'next/server';\nimport { isVippsToken } from '../../core/portal/vipps-link';\nimport { maskedAddress, VIPPS_CONFIRM_QUERY } from '../../core/portal/vipps-return';\nimport { PortalSessionExpiredError, PortalThrottledError } from '../portal/medal-portal';\nimport type { VippsLinkFlash } from '../portal/vipps-flash';\nimport type { BookingRuntime } from '../runtime';\n\n/** Whether the portal is on for this request (the site's switch, else the config). */\nexport async function portalEnabled(rt: BookingRuntime): Promise<boolean> {\n  if (rt.paths.portal === null) return false;\n  const enabled = rt.options.portal?.enabled;\n  return enabled ? enabled() : rt.config.portal.enabled;\n}\n\nfunction seeOther(path: string, request: Request, headers: Record<string, string> = {}): Response {\n  const location = new URL(path, request.url);\n  return new NextResponse(null, {\n    status: 303,\n    headers: { Location: location.toString(), 'Cache-Control': 'no-store', ...headers },\n  });\n}\n\nconst VIPPS_LOGIN_QUERY = 'vipps';\n\n/**\n * `GET <vippsReturnPath>` — where Vipps sends the parent back, and the one\n * place a Vipps grant becomes a session cookie.\n *\n * Medal lands the browser here with exactly one of: `?grant=<opaque>` (a\n * session is waiting), `?vipps=cancelled`, `?vipps=needs_email_login` (more\n * than one profile, log in with e-mail to pick one), `?vipps=confirm_email`\n * (one plausible profile, a code is on its way) or `?vipps=failed`.\n *\n * The cookie is written on ONE branch: a grant Medal accepted, arriving in\n * the browser that started the login (it holds the binding cookie). A grant\n * in any other browser is never exchanged. That, a grant Medal refused, or an\n * exchange that could not be made at all goes to the login with\n * `?vipps=failed` and the e-mail form; so does anything unrecognised.\n *\n * WHERE THE PARENT LANDS is the portal unless a login that started somewhere\n * else said otherwise; that destination travels in a read-once httpOnly\n * cookie (`core/portal/next-path.ts`), re-validated on the way out, and it is\n * taken on EVERY branch.\n */\nexport async function vippsReturnRoute(rt: BookingRuntime, request: Request): Promise<Response> {\n  // A route handler runs no layout, so the portal's gate is repeated here:\n  // this is the one address under the account a third party can send a\n  // browser to.\n  if (!(await portalEnabled(rt))) return seeOther('/', request);\n  const portalPath = rt.paths.portal as string;\n  const login = rt.paths.portalLogin;\n  const loginWith = (outcome: 'needs_email_login' | 'failed') =>\n    `${login}?${VIPPS_LOGIN_QUERY}=${outcome}`;\n\n  const { searchParams } = new URL(request.url);\n  const grant = searchParams.get('grant');\n  // Read once, before any branch returns: the value describes THIS attempt.\n  const next = await rt.nextPath.takePortalNextPath();\n\n  if (grant) {\n    // LOGIN CSRF. A grant is a session for whichever Vipps account finished\n    // the login, so one lifted from an attacker's own callback and sent to a\n    // parent as a link would sign the parent into the attacker's account —\n    // where they would then type their own and their children's details.\n    // Only the browser that STARTED a login holds its binding (minted per\n    // attempt by `startVipps`, httpOnly and `__Host-`), so no binding (a\n    // malformed one reads as none) is no exchange: the grant is left unspent\n    // and the parent goes to the login. The binding is read before anything\n    // is cleared, and spent only once it has been checked.\n    //\n    // PRESENCE, NOT A MATCH. Medal's `/vipps/exchange` takes the grant alone\n    // and does not keep the binding with it, so this proves the browser\n    // started A Vipps login in the last fifteen minutes — not that the grant\n    // came from THAT login. Binding the grant itself is Medal's half: it has\n    // to keep the binding's hash on the grant and require it on exchange, as\n    // `/me/vipps/link/complete` already does.\n    const binding = await rt.vippsLink.readBrowserBinding();\n    if (binding === null) {\n      rt.logger.warn({}, 'Vipps grant arrived without this browser’s login binding');\n      return seeOther(next ?? loginWith('failed'), request);\n    }\n    // A grant needs no pending link, so this attempt's binding is spent.\n    await rt.vippsLink.clearBrowserBinding();\n    let session: Awaited<ReturnType<BookingRuntime['portal']['exchangeVippsGrant']>>;\n    try {\n      session = await rt.portal.exchangeVippsGrant(grant);\n    } catch (error) {\n      rt.logger.error({ err: error }, 'Vipps grant could not be exchanged');\n      return seeOther(next ?? loginWith('failed'), request);\n    }\n    if (session === null) return seeOther(next ?? loginWith('failed'), request);\n    await rt.session.writePortalSession(session.sessionToken, session.expiresAt);\n    return seeOther(next ?? portalPath, request);\n  }\n\n  // Medal found one plausible profile and e-mailed its address a code. The\n  // link moves into an httpOnly cookie scoped to the route that spends it,\n  // and the parent goes on with only the marker and the masked address.\n  if (searchParams.get(VIPPS_LOGIN_QUERY) === VIPPS_CONFIRM_QUERY) {\n    const link = searchParams.getAll('link');\n    // No binding cookie means this browser did not start the login — or its\n    // cookie expired — and Medal would refuse the code whatever was typed.\n    if (\n      link.length !== 1 ||\n      !isVippsToken(link[0]) ||\n      (await rt.vippsLink.readBrowserBinding()) === null\n    ) {\n      return seeOther(next ?? loginWith('failed'), request);\n    }\n    await rt.vippsLink.writePendingLink(link[0]);\n    const target = new URL(next ?? login, request.url);\n    target.searchParams.set(VIPPS_LOGIN_QUERY, VIPPS_CONFIRM_QUERY);\n    const to = maskedAddress(searchParams.get('to'));\n    if (to !== null) target.searchParams.set('to', to);\n    return seeOther(`${target.pathname}${target.search}`, request);\n  }\n\n  // A login that started outside the portal goes back where it started,\n  // whatever the outcome was.\n  if (next !== null) return seeOther(next, request);\n\n  switch (searchParams.get(VIPPS_LOGIN_QUERY)) {\n    case 'cancelled':\n      return seeOther(login, request);\n    case 'needs_email_login':\n      return seeOther(loginWith('needs_email_login'), request);\n    default:\n      return seeOther(loginWith('failed'), request);\n  }\n}\n\nconst GRANT_KEY = 'link_grant';\nconst MARKER_KEY = 'vipps';\n\n/**\n * What a bare marker may say: a sentence at most. `linked` without a grant is\n * not proof of anything and says nothing; `cancelled` says nothing either.\n */\nfunction markerFlash(value: string | null): VippsLinkFlash | null {\n  if (value === 'linked' || value === 'cancelled') return null;\n  if (value === 'link_conflict') return 'link_conflict';\n  return 'link_failed';\n}\n\n/**\n * `GET <vippsLinkReturnPath>` — where Vipps, via Medal, sends a LOGGED-IN\n * parent back from «link Vipps» on the profile.\n *\n * `?link_grant=<43 chars>` is a one-time link grant this handler spends with\n * the parent's session and this browser's binding; `?vipps=link_conflict`,\n * `cancelled` or `failed` are bare markers.\n *\n * NOTHING IN THE QUERY IS TRUSTED AS AN OUTCOME, AND NOTHING STAYS IN IT.\n * Every answer is a 303 to a bare portal URL with `Referrer-Policy:\n * no-referrer`; the outcome travels as an httpOnly flash cookie, and `linked`\n * is written ONLY after Medal accepted a grant this handler exchanged.\n *\n * The binding is spent once Medal has answered about an exchanged grant. A\n * navigation without a grant, a malformed grant, a throttle or an outage\n * leave it to expire on its own. A session Medal no longer honours is cleared\n * here and the parent goes to the login.\n */\nexport async function vippsLinkReturnRoute(\n  rt: BookingRuntime,\n  request: Request\n): Promise<Response> {\n  const noReferrer = { 'Referrer-Policy': 'no-referrer' };\n  if (!(await portalEnabled(rt))) return seeOther('/', request, noReferrer);\n  const portalPath = rt.paths.portal as string;\n\n  const session = await rt.session.readPortalSession();\n  if (session === null) return seeOther(rt.paths.portalLogin, request, noReferrer);\n\n  const landWith = async (flash: VippsLinkFlash | null) => {\n    if (flash !== null) await rt.flash.writeVippsLinkFlash(flash);\n    return seeOther(portalPath, request, noReferrer);\n  };\n\n  const { searchParams } = new URL(request.url);\n  const grants = searchParams.getAll(GRANT_KEY);\n  if (grants.length > 0) {\n    const flash = await spendGrant(rt, session, grants);\n    if (flash === 'session') return seeOther(rt.paths.portalLogin, request, noReferrer);\n    return landWith(flash);\n  }\n  return landWith(markerFlash(searchParams.get(MARKER_KEY)));\n}\n\n/** Spend one well-formed grant with this browser's binding; what the profile should say. */\nasync function spendGrant(\n  rt: BookingRuntime,\n  session: string,\n  grants: string[]\n): Promise<VippsLinkFlash | 'session'> {\n  const binding = await rt.vippsLink.readBrowserBinding();\n  if (grants.length !== 1 || !isVippsToken(grants[0]) || binding === null) return 'link_failed';\n  try {\n    const outcome = await rt.portal.completeVippsLink(session, {\n      grant: grants[0],\n      browserBinding: binding,\n    });\n    // Medal has answered about THIS grant, and every answer spends it.\n    await rt.vippsLink.clearBrowserBinding();\n    if (outcome === 'linked') return 'linked';\n    return outcome === 'conflict' ? 'link_conflict' : 'link_failed';\n  } catch (error) {\n    if (error instanceof PortalSessionExpiredError) {\n      await rt.session.clearPortalSession();\n      return 'session';\n    }\n    if (!(error instanceof PortalThrottledError)) {\n      rt.logger.error({ err: error }, 'Vipps link grant could not be completed');\n    }\n    return 'link_failed';\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAiBA,eAAsB,cAAc,IAAsC;CACxE,IAAI,GAAG,MAAM,WAAW,MAAM,OAAO;CACrC,MAAM,UAAU,GAAG,QAAQ,QAAQ;CACnC,OAAO,UAAU,QAAQ,IAAI,GAAG,OAAO,OAAO;AAChD;AAEA,SAAS,SAAS,MAAc,SAAkB,UAAkC,CAAC,GAAa;CAChG,MAAM,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;CAC1C,OAAO,IAAI,aAAa,MAAM;EAC5B,QAAQ;EACR,SAAS;GAAE,UAAU,SAAS,SAAS;GAAG,iBAAiB;GAAY,GAAG;EAAQ;CACpF,CAAC;AACH;AAEA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;AAsB1B,eAAsB,iBAAiB,IAAoB,SAAqC;CAI9F,IAAI,CAAE,MAAM,cAAc,EAAE,GAAI,OAAO,SAAS,KAAK,OAAO;CAC5D,MAAM,aAAa,GAAG,MAAM;CAC5B,MAAM,QAAQ,GAAG,MAAM;CACvB,MAAM,aAAa,YACjB,GAAG,MAAM,GAAG,kBAAkB,GAAG;CAEnC,MAAM,EAAE,iBAAiB,IAAI,IAAI,QAAQ,GAAG;CAC5C,MAAM,QAAQ,aAAa,IAAI,OAAO;CAEtC,MAAM,OAAO,MAAM,GAAG,SAAS,mBAAmB;CAElD,IAAI,OAAO;EAkBT,IAAI,MADkB,GAAG,UAAU,mBAAmB,MACtC,MAAM;GACpB,GAAG,OAAO,KAAK,CAAC,GAAG,0DAA0D;GAC7E,OAAO,SAAS,QAAQ,UAAU,QAAQ,GAAG,OAAO;EACtD;EAEA,MAAM,GAAG,UAAU,oBAAoB;EACvC,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,GAAG,OAAO,mBAAmB,KAAK;EACpD,SAAS,OAAO;GACd,GAAG,OAAO,MAAM,EAAE,KAAK,MAAM,GAAG,oCAAoC;GACpE,OAAO,SAAS,QAAQ,UAAU,QAAQ,GAAG,OAAO;EACtD;EACA,IAAI,YAAY,MAAM,OAAO,SAAS,QAAQ,UAAU,QAAQ,GAAG,OAAO;EAC1E,MAAM,GAAG,QAAQ,mBAAmB,QAAQ,cAAc,QAAQ,SAAS;EAC3E,OAAO,SAAS,QAAQ,YAAY,OAAO;CAC7C;CAKA,IAAI,aAAa,IAAI,iBAAiB,MAAA,iBAA2B;EAC/D,MAAM,OAAO,aAAa,OAAO,MAAM;EAGvC,IACE,KAAK,WAAW,KAChB,CAAC,aAAa,KAAK,EAAE,KACpB,MAAM,GAAG,UAAU,mBAAmB,MAAO,MAE9C,OAAO,SAAS,QAAQ,UAAU,QAAQ,GAAG,OAAO;EAEtD,MAAM,GAAG,UAAU,iBAAiB,KAAK,EAAE;EAC3C,MAAM,SAAS,IAAI,IAAI,QAAQ,OAAO,QAAQ,GAAG;EACjD,OAAO,aAAa,IAAI,mBAAmB,mBAAmB;EAC9D,MAAM,KAAK,cAAc,aAAa,IAAI,IAAI,CAAC;EAC/C,IAAI,OAAO,MAAM,OAAO,aAAa,IAAI,MAAM,EAAE;EACjD,OAAO,SAAS,GAAG,OAAO,WAAW,OAAO,UAAU,OAAO;CAC/D;CAIA,IAAI,SAAS,MAAM,OAAO,SAAS,MAAM,OAAO;CAEhD,QAAQ,aAAa,IAAI,iBAAiB,GAA1C;EACE,KAAK,aACH,OAAO,SAAS,OAAO,OAAO;EAChC,KAAK,qBACH,OAAO,SAAS,UAAU,mBAAmB,GAAG,OAAO;EACzD,SACE,OAAO,SAAS,UAAU,QAAQ,GAAG,OAAO;CAChD;AACF;AAEA,MAAM,YAAY;AAClB,MAAM,aAAa;;;;;AAMnB,SAAS,YAAY,OAA6C;CAChE,IAAI,UAAU,YAAY,UAAU,aAAa,OAAO;CACxD,IAAI,UAAU,iBAAiB,OAAO;CACtC,OAAO;AACT;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,qBACpB,IACA,SACmB;CACnB,MAAM,aAAa,EAAE,mBAAmB,cAAc;CACtD,IAAI,CAAE,MAAM,cAAc,EAAE,GAAI,OAAO,SAAS,KAAK,SAAS,UAAU;CACxE,MAAM,aAAa,GAAG,MAAM;CAE5B,MAAM,UAAU,MAAM,GAAG,QAAQ,kBAAkB;CACnD,IAAI,YAAY,MAAM,OAAO,SAAS,GAAG,MAAM,aAAa,SAAS,UAAU;CAE/E,MAAM,WAAW,OAAO,UAAiC;EACvD,IAAI,UAAU,MAAM,MAAM,GAAG,MAAM,oBAAoB,KAAK;EAC5D,OAAO,SAAS,YAAY,SAAS,UAAU;CACjD;CAEA,MAAM,EAAE,iBAAiB,IAAI,IAAI,QAAQ,GAAG;CAC5C,MAAM,SAAS,aAAa,OAAO,SAAS;CAC5C,IAAI,OAAO,SAAS,GAAG;EACrB,MAAM,QAAQ,MAAM,WAAW,IAAI,SAAS,MAAM;EAClD,IAAI,UAAU,WAAW,OAAO,SAAS,GAAG,MAAM,aAAa,SAAS,UAAU;EAClF,OAAO,SAAS,KAAK;CACvB;CACA,OAAO,SAAS,YAAY,aAAa,IAAI,UAAU,CAAC,CAAC;AAC3D;;AAGA,eAAe,WACb,IACA,SACA,QACqC;CACrC,MAAM,UAAU,MAAM,GAAG,UAAU,mBAAmB;CACtD,IAAI,OAAO,WAAW,KAAK,CAAC,aAAa,OAAO,EAAE,KAAK,YAAY,MAAM,OAAO;CAChF,IAAI;EACF,MAAM,UAAU,MAAM,GAAG,OAAO,kBAAkB,SAAS;GACzD,OAAO,OAAO;GACd,gBAAgB;EAClB,CAAC;EAED,MAAM,GAAG,UAAU,oBAAoB;EACvC,IAAI,YAAY,UAAU,OAAO;EACjC,OAAO,YAAY,aAAa,kBAAkB;CACpD,SAAS,OAAO;EACd,IAAI,iBAAiB,2BAA2B;GAC9C,MAAM,GAAG,QAAQ,mBAAmB;GACpC,OAAO;EACT;EACA,IAAI,EAAE,iBAAiB,uBACrB,GAAG,OAAO,MAAM,EAAE,KAAK,MAAM,GAAG,yCAAyC;EAE3E,OAAO;CACT;AACF"}

package/dist/next/runtime.d.mts

@@ -0,0 +1,49 @@
+import { BookingConfig } from "../core/config.mjs";
+import { createClock } from "../core/clock.mjs";
+import { createDto } from "../core/dto.mjs";
+import { createPaths } from "../core/paths.mjs";
+import { createPhone } from "../core/phone.mjs";
+import { CookieSource } from "../core/portal/cookies.mjs";
+import { createPortalNextPath } from "../core/portal/next-path.mjs";
+import { createVippsLinkCookies } from "../core/portal/vipps-link.mjs";
+import { MedalSeam } from "./medal.mjs";
+import { BookingLogger, BookingServerOptions, PortalMessages } from "./options.mjs";
+import { Catalogue } from "./catalogue.mjs";
+import { PortalSeam } from "./portal/medal-portal.mjs";
+import { createGuardian } from "./portal/guardian.mjs";
+import { PortalSession } from "./portal/session.mjs";
+import { VippsFlash } from "./portal/vipps-flash.mjs";
+import { Seed } from "./seed.mjs";
+//#region src/next/runtime.d.ts
+export interface BookingRuntime {
+  options: BookingServerOptions;
+  config: Readonly<BookingConfig>;
+  logger: BookingLogger;
+  cookies: CookieSource;
+  medal: MedalSeam;
+  catalogue: Catalogue;
+  seed: Seed;
+  portal: PortalSeam;
+  session: PortalSession;
+  guardianFromSession: ReturnType<typeof createGuardian>;
+  nextPath: ReturnType<typeof createPortalNextPath>;
+  vippsLink: ReturnType<typeof createVippsLinkCookies>;
+  flash: VippsFlash;
+  dto: ReturnType<typeof createDto>;
+  clock: ReturnType<typeof createClock>;
+  phone: ReturnType<typeof createPhone>;
+  paths: ReturnType<typeof createPaths> & {
+    /** `null` when the site has no portal. */
+    portal: string | null;
+    portalLogin: string;
+    sessionExpired: string;
+    vippsReturn: string;
+    vippsLinkReturn: string;
+  };
+  messages: PortalMessages;
+  /** The site's canonical origin, for a request that names none. */
+  baseUrl(): string | undefined;
+}
+export declare function createBookingRuntime(options: BookingServerOptions, overrides?: Partial<BookingRuntime>): BookingRuntime;
+//#endregion
+//# sourceMappingURL=runtime.d.mts.map

package/dist/next/runtime.mjs

@@ -0,0 +1,94 @@
+import { createClock } from "../core/clock.mjs";
+import { createDto } from "../core/dto.mjs";
+import { createPaths } from "../core/paths.mjs";
+import { createPhone } from "../core/phone.mjs";
+import { createPortalNextPath } from "../core/portal/next-path.mjs";
+import { createVippsLinkCookies } from "../core/portal/vipps-link.mjs";
+import { DEFAULT_PORTAL_MESSAGES, SILENT_LOGGER } from "./options.mjs";
+import { createCatalogue } from "./catalogue.mjs";
+import { createMedalSeam } from "./medal.mjs";
+import { createGuardian } from "./portal/guardian.mjs";
+import { createPortalSeam } from "./portal/medal-portal.mjs";
+import { createPortalSession } from "./portal/session.mjs";
+import { createVippsFlash } from "./portal/vipps-flash.mjs";
+import { createSeed } from "./seed.mjs";
+import { cookies } from "next/headers";
+//#region src/next/runtime.ts
+/**
+* One booking site's server half, wired once: the Medal seam, the two caches,
+* the seed, the portal seam and the cookie helpers, all built from one
+* `BookingServerOptions`. The handler, the loaders and the portal actions are
+* views over the same runtime, so a site that builds one with
+* `createBookingServer` shares its in-flight refreshes and its clients
+* across all three.
+*
+* Every part can be replaced (`overrides`) — the tests do, and a site with an
+* unusual Medal setup can.
+*/
+/** Next's own jar, typed as the package's (a structural subset). */
+const defaultCookies = async () => await cookies();
+function createBookingRuntime(options, overrides = {}) {
+	const { config } = options;
+	const logger = overrides.logger ?? options.logger ?? SILENT_LOGGER;
+	const cookies = overrides.cookies ?? options.cookies ?? defaultCookies;
+	const medal = overrides.medal ?? createMedalSeam(options.medal);
+	const catalogue = overrides.catalogue ?? createCatalogue({
+		config,
+		cache: options.cache,
+		logger
+	}, medal);
+	const seed = overrides.seed ?? createSeed({
+		config,
+		cache: options.cache,
+		logger,
+		timing: options.timing
+	}, catalogue);
+	const messages = {
+		...DEFAULT_PORTAL_MESSAGES,
+		...options.portal?.messages
+	};
+	const portal = overrides.portal ?? createPortalSeam(medal, {
+		config,
+		messages
+	});
+	const portalPath = config.paths.portal;
+	const portalBase = portalPath ?? config.paths.booking;
+	return {
+		options,
+		config,
+		logger,
+		cookies,
+		medal,
+		catalogue,
+		seed,
+		portal,
+		session: overrides.session ?? createPortalSession(config, cookies),
+		guardianFromSession: overrides.guardianFromSession ?? createGuardian(portal, logger),
+		nextPath: overrides.nextPath ?? createPortalNextPath(config, cookies),
+		vippsLink: overrides.vippsLink ?? createVippsLinkCookies(config, cookies),
+		flash: overrides.flash ?? createVippsFlash({
+			cookieName: options.portal?.vippsFlashCookieName ?? `${config.portal.cookieName}_vipps_flash`,
+			path: portalBase
+		}, cookies),
+		dto: overrides.dto ?? createDto(config),
+		clock: overrides.clock ?? createClock(config),
+		phone: overrides.phone ?? createPhone(config),
+		paths: overrides.paths ?? {
+			...createPaths(config),
+			portal: portalPath,
+			portalLogin: config.paths.portalLogin,
+			sessionExpired: `${config.paths.portalApi}/session/expired`,
+			vippsReturn: options.portal?.vippsReturnPath ?? `${portalBase}/vipps`,
+			vippsLinkReturn: options.portal?.vippsLinkReturnPath ?? `${portalBase}/vipps/link`
+		},
+		messages,
+		baseUrl: overrides.baseUrl ?? (() => {
+			const value = options.baseUrl;
+			return typeof value === "function" ? value() : value;
+		})
+	};
+}
+//#endregion
+export { createBookingRuntime };
+
+//# sourceMappingURL=runtime.mjs.map

package/dist/next/runtime.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.mjs","names":["nextCookies"],"sources":["../../src/next/runtime.ts"],"sourcesContent":["/**\n * One booking site's server half, wired once: the Medal seam, the two caches,\n * the seed, the portal seam and the cookie helpers, all built from one\n * `BookingServerOptions`. The handler, the loaders and the portal actions are\n * views over the same runtime, so a site that builds one with\n * `createBookingServer` shares its in-flight refreshes and its clients\n * across all three.\n *\n * Every part can be replaced (`overrides`) — the tests do, and a site with an\n * unusual Medal setup can.\n */\n\nimport { cookies as nextCookies } from 'next/headers';\nimport { createClock } from '../core/clock';\nimport type { BookingConfig } from '../core/config';\nimport { createDto } from '../core/dto';\nimport { createPaths } from '../core/paths';\nimport { createPhone } from '../core/phone';\nimport type { CookieJar, CookieSource } from '../core/portal/cookies';\nimport { createPortalNextPath } from '../core/portal/next-path';\nimport { createVippsLinkCookies } from '../core/portal/vipps-link';\nimport { type Catalogue, createCatalogue } from './catalogue';\nimport { createMedalSeam, type MedalSeam } from './medal';\nimport type { BookingLogger, BookingServerOptions, PortalMessages } from './options';\nimport { DEFAULT_PORTAL_MESSAGES, SILENT_LOGGER } from './options';\nimport { createGuardian } from './portal/guardian';\nimport { createPortalSeam, type PortalSeam } from './portal/medal-portal';\nimport { createPortalSession, type PortalSession } from './portal/session';\nimport { createVippsFlash, type VippsFlash } from './portal/vipps-flash';\nimport { createSeed, type Seed } from './seed';\n\nexport interface BookingRuntime {\n  options: BookingServerOptions;\n  config: Readonly<BookingConfig>;\n  logger: BookingLogger;\n  cookies: CookieSource;\n  medal: MedalSeam;\n  catalogue: Catalogue;\n  seed: Seed;\n  portal: PortalSeam;\n  session: PortalSession;\n  guardianFromSession: ReturnType<typeof createGuardian>;\n  nextPath: ReturnType<typeof createPortalNextPath>;\n  vippsLink: ReturnType<typeof createVippsLinkCookies>;\n  flash: VippsFlash;\n  dto: ReturnType<typeof createDto>;\n  clock: ReturnType<typeof createClock>;\n  phone: ReturnType<typeof createPhone>;\n  paths: ReturnType<typeof createPaths> & {\n    /** `null` when the site has no portal. */\n    portal: string | null;\n    portalLogin: string;\n    sessionExpired: string;\n    vippsReturn: string;\n    vippsLinkReturn: string;\n  };\n  messages: PortalMessages;\n  /** The site's canonical origin, for a request that names none. */\n  baseUrl(): string | undefined;\n}\n\n/** Next's own jar, typed as the package's (a structural subset). */\nconst defaultCookies: CookieSource = async () => (await nextCookies()) as unknown as CookieJar;\n\nexport function createBookingRuntime(\n  options: BookingServerOptions,\n  overrides: Partial<BookingRuntime> = {}\n): BookingRuntime {\n  const { config } = options;\n  const logger = overrides.logger ?? options.logger ?? SILENT_LOGGER;\n  const cookies = overrides.cookies ?? options.cookies ?? defaultCookies;\n  const medal = overrides.medal ?? createMedalSeam(options.medal);\n  const catalogue =\n    overrides.catalogue ?? createCatalogue({ config, cache: options.cache, logger }, medal);\n  const seed =\n    overrides.seed ??\n    createSeed({ config, cache: options.cache, logger, timing: options.timing }, catalogue);\n  const messages = { ...DEFAULT_PORTAL_MESSAGES, ...options.portal?.messages };\n  const portal = overrides.portal ?? createPortalSeam(medal, { config, messages });\n  const portalPath = config.paths.portal;\n  const portalBase = portalPath ?? config.paths.booking;\n  return {\n    options,\n    config,\n    logger,\n    cookies,\n    medal,\n    catalogue,\n    seed,\n    portal,\n    session: overrides.session ?? createPortalSession(config, cookies),\n    guardianFromSession: overrides.guardianFromSession ?? createGuardian(portal, logger),\n    nextPath: overrides.nextPath ?? createPortalNextPath(config, cookies),\n    vippsLink: overrides.vippsLink ?? createVippsLinkCookies(config, cookies),\n    flash:\n      overrides.flash ??\n      createVippsFlash(\n        {\n          cookieName:\n            options.portal?.vippsFlashCookieName ?? `${config.portal.cookieName}_vipps_flash`,\n          path: portalBase,\n        },\n        cookies\n      ),\n    dto: overrides.dto ?? createDto(config),\n    clock: overrides.clock ?? createClock(config),\n    phone: overrides.phone ?? createPhone(config),\n    paths: overrides.paths ?? {\n      ...createPaths(config),\n      portal: portalPath,\n      portalLogin: config.paths.portalLogin,\n      sessionExpired: `${config.paths.portalApi}/session/expired`,\n      vippsReturn: options.portal?.vippsReturnPath ?? `${portalBase}/vipps`,\n      vippsLinkReturn: options.portal?.vippsLinkReturnPath ?? `${portalBase}/vipps/link`,\n    },\n    messages,\n    baseUrl:\n      overrides.baseUrl ??\n      (() => {\n        const value = options.baseUrl;\n        return typeof value === 'function' ? value() : value;\n      }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,MAAM,iBAA+B,YAAa,MAAMA,QAAY;AAEpE,SAAgB,qBACd,SACA,YAAqC,CAAC,GACtB;CAChB,MAAM,EAAE,WAAW;CACnB,MAAM,SAAS,UAAU,UAAU,QAAQ,UAAU;CACrD,MAAM,UAAU,UAAU,WAAW,QAAQ,WAAW;CACxD,MAAM,QAAQ,UAAU,SAAS,gBAAgB,QAAQ,KAAK;CAC9D,MAAM,YACJ,UAAU,aAAa,gBAAgB;EAAE;EAAQ,OAAO,QAAQ;EAAO;CAAO,GAAG,KAAK;CACxF,MAAM,OACJ,UAAU,QACV,WAAW;EAAE;EAAQ,OAAO,QAAQ;EAAO;EAAQ,QAAQ,QAAQ;CAAO,GAAG,SAAS;CACxF,MAAM,WAAW;EAAE,GAAG;EAAyB,GAAG,QAAQ,QAAQ;CAAS;CAC3E,MAAM,SAAS,UAAU,UAAU,iBAAiB,OAAO;EAAE;EAAQ;CAAS,CAAC;CAC/E,MAAM,aAAa,OAAO,MAAM;CAChC,MAAM,aAAa,cAAc,OAAO,MAAM;CAC9C,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,UAAU,WAAW,oBAAoB,QAAQ,OAAO;EACjE,qBAAqB,UAAU,uBAAuB,eAAe,QAAQ,MAAM;EACnF,UAAU,UAAU,YAAY,qBAAqB,QAAQ,OAAO;EACpE,WAAW,UAAU,aAAa,uBAAuB,QAAQ,OAAO;EACxE,OACE,UAAU,SACV,iBACE;GACE,YACE,QAAQ,QAAQ,wBAAwB,GAAG,OAAO,OAAO,WAAW;GACtE,MAAM;EACR,GACA,OACF;EACF,KAAK,UAAU,OAAO,UAAU,MAAM;EACtC,OAAO,UAAU,SAAS,YAAY,MAAM;EAC5C,OAAO,UAAU,SAAS,YAAY,MAAM;EAC5C,OAAO,UAAU,SAAS;GACxB,GAAG,YAAY,MAAM;GACrB,QAAQ;GACR,aAAa,OAAO,MAAM;GAC1B,gBAAgB,GAAG,OAAO,MAAM,UAAU;GAC1C,aAAa,QAAQ,QAAQ,mBAAmB,GAAG,WAAW;GAC9D,iBAAiB,QAAQ,QAAQ,uBAAuB,GAAG,WAAW;EACxE;EACA;EACA,SACE,UAAU,kBACH;GACL,MAAM,QAAQ,QAAQ;GACtB,OAAO,OAAO,UAAU,aAAa,MAAM,IAAI;EACjD;CACJ;AACF"}

package/dist/next/seed.d.mts

@@ -0,0 +1,71 @@
+import { BookingConfig } from "../core/config.mjs";
+import { BookingDayDto, BookingResourceDto, BookingServiceDto, BookingSlotDto } from "../core/types.mjs";
+import { BookingCacheAdapter, BookingLogger, BookingTiming } from "./options.mjs";
+import { Catalogue } from "./catalogue.mjs";
+//#region src/next/seed.d.ts
+export declare const SEED_STALE_MAX_MS: number;
+/**
+ * How long after the first delete the second one runs. The first can land
+ * BEFORE the write it answers is visible to a concurrent seed build: the slot
+ * tag expiry is written in the platform's deferred work, and a booking-page
+ * miss already in flight puts the seed it built from pre-booking slots once it
+ * is done. Either puts a stale seed back after the first delete; the second
+ * pass removes it. A build that starts after the tag expiry has landed reads
+ * live.
+ */
+export declare const SEED_RECHECK_MS = 2000;
+export interface BookingCatalogue {
+  services: BookingServiceDto[];
+  /** `null` when the stylists could not be read; the wizard fetches them. */
+  resources: BookingResourceDto[] | null;
+}
+export interface BookingSeed extends BookingCatalogue {
+  slots: Record<string, BookingSlotDto[]>;
+  schedules: Record<string, BookingDayDto[]>;
+  nextAvailable: Record<string, Record<string, number>>;
+  /** When the slot/schedule part was read from `catalogue.ts`. */
+  generatedAt: number;
+  /** The window the slots and schedules describe. */
+  fromTs: number;
+  toTs: number;
+}
+/** How a seed read ended, for `x-booking-seed` and the timing sink. */
+export type SeedState = 'hit' | 'stale' | 'miss' | 'bypass';
+export interface SeedOptions {
+  config: Pick<BookingConfig, 'timeZone' | 'locale' | 'dayparts' | 'window' | 'categories' | 'fallbackCategory' | 'paths'>;
+  cache: {
+    edge: BookingCacheAdapter;
+    environment: string;
+    edgePrefix?: string;
+  };
+  logger: BookingLogger;
+  timing?: BookingTiming;
+}
+export interface Seed {
+  /** The window the wizard shows and prefetches for, in local days. */
+  readonly RANGE_DAYS: number;
+  /** How many services to warm the cache with. */
+  readonly PREFETCH_LIMIT: number;
+  prefetchTargets(services: BookingServiceDto[], named: string | undefined): BookingServiceDto[];
+  prefetchKey(targets: readonly {
+    id: string;
+  }[]): string;
+  seedBucket(now: number): number;
+  expiryMarkerKey(serviceId: string): string | null;
+  anyExpiryMarkerKey(): string | null;
+  catalogueKeyAt(now: number): string | null;
+  catalogueLatestKey(): string | null;
+  seedLatestKeyAt(key: string, now: number): string | null;
+  seedKeyAt(key: string, now: number): string | null;
+  loadBookingCatalogue(now?: number): Promise<BookingCatalogue>;
+  loadBookingSeed(named: string | undefined, now?: number): Promise<BookingSeed>;
+  allPrefetchKeys(services: BookingServiceDto[]): string[];
+  seedKeysFor(services: BookingServiceDto[], serviceIds: Iterable<string>, now: number): string[];
+  expireBookingSeeds(serviceIds: Iterable<string>, now?: number, recheckAfterMs?: number): Promise<void>;
+  /** Test seam: forget in-flight refreshes. */
+  resetSeedRefreshes(): void;
+}
+type SeedCatalogue = Pick<Catalogue, 'cachedServices' | 'cachedResources' | 'cachedAvailability' | 'cachedSchedule'>;
+export declare function createSeed(options: SeedOptions, catalogue: SeedCatalogue): Seed;
+//#endregion
+//# sourceMappingURL=seed.d.mts.map