@proveanything/smartlinks 2.0.69 → 2.0.71

package/dist/docs/server-functions.md

@@ -587,7 +587,10 @@ Key records to the returned canonical `id`, and refuse `null` — otherwise anyo
 empty fields** — it never overwrites a name or field the contact already has, because a visitor's typed
 details are unverified. It's race-safe: two simultaneous entries with one email end on one contact.
 Returns `{ contactId, created }`. `forCaller()` is the signed-in caller's own contact (`null` when
-anonymous). **Never return contact ids to public callers** — keep them on your records.
+anonymous): `{ contactId, email, phone, firstName, lastName, displayName, tags, customFields }`. Use it
+to check what a member is before returning member-only content — a level the staff set
+(`customFields.level`), a tag. It includes staff-only fields, so return only what the caller may see
+(see members.md). **Never return contact ids to public callers** — keep them on your records.
 
 This is not consent. A ticked "keep me updated" box is evidence you can record (below); subscribing
 someone to marketing is the double opt-in flow (`comms.signup`, see comms.md).

package/dist/http.js

@@ -216,6 +216,9 @@ function shouldSkipCache(path) {
     // Never cache /me endpoints (contact/me, loyalty/me, etc.) — always user-specific.
     if (/\/me(\?|$)/i.test(path))
         return true;
+    // Bookings change by the second (places left, busy times, a booking's status) — never serve them stale.
+    if (/\/app\/[^/]+\/bookings(\/|\?|$)/i.test(path))
+        return true;
     return false;
 }
 /** Evict the oldest (LRU) entry when the cache is at capacity. */