# noona.is — Noona

Iceland's booking platform ([noona.is](https://noona.is)). Search businesses,
list services, check availability, view your bookings — and book/cancel.

## Auth

Phone number + SMS code → long-lived HS256 JWT (issued per phone number,
effectively non-expiring).

```bash
ab-plus login noona.is       # store NOONA_TOKEN in the macOS Keychain
```

The token never goes in a recipe file, a repo, or a chat. The CLI also reads
`NOONA_TOKEN` env and `~/.noona-token` (legacy, plaintext — prefer keychain).

## Ops

| Op | Risk | Notes |
|---|---|---|
| `search` | read-only | Search enterprises |
| `services` | read-only | Event types + prices + prepayment flag |
| `availability` | read-only | Time slots over a date range |
| `bookings` | read-only | Your upcoming bookings |
| `book` | **mutating** | Two-step (reservation → event). Refuses prepaid services. `--confirm` required, `--dry-run` supported |
| `cancel` | **mutating** | `--confirm` required |

## Gotchas

- Booking is not idempotent — a retried `book` creates a second appointment.
- The prepayment guard is deliberate: `book` fails loudly rather than charge.
- 429 on `verify_phone_number` → wait a minute before retrying the OTP.