@medalsocial/booking 0.0.0-placeholder.0 → 0.2.0

package/dist/next/portal.mjs

@@ -0,0 +1,469 @@
+import { emailField, verifyLoginInput } from "../core/portal/login-input.mjs";
+import { mintBrowserBinding } from "../core/portal/vipps-link.mjs";
+import { PortalSessionExpiredError, PortalThrottledError, PortalValidationError, PortalVippsUnavailableError } from "./portal/medal-portal.mjs";
+import { originFromHeaders } from "./request.mjs";
+import { vippsLinkReturnRoute, vippsReturnRoute } from "./routes/vipps-return.mjs";
+import { z } from "zod";
+import { redirect } from "next/navigation";
+import { headers } from "next/headers";
+import { revalidatePath } from "next/cache";
+//#region src/next/portal.ts
+/**
+* The customer portal's server half: the session cookie, the action functions
+* behind the portal's forms, and the two Vipps return routes.
+*
+* SERVER ACTIONS STAY IN THE APP. A library cannot ship `'use server'` exports
+* reliably, so these are plain async functions and the app wraps each in a
+* three-line action:
+*
+* ```ts
+* 'use server';
+* export async function updateProfileAction(input: unknown) {
+*   return booking.portal.actions.updateProfile(input);
+* }
+* ```
+*
+* The components receive the actions as props, so nothing in the package
+* imports from an app file.
+*
+* Every action keeps the same two obligations:
+*
+* - **The session never leaves the server.** It is read from the cookie
+*   inside `withPortalSession`, handed to the seam, and appears in no return
+*   value — an action's result is serialised into the browser.
+* - **A dead session is an answer, not an error.** Medal saying the cookie is
+*   no longer honoured comes back as `{ ok: false, reason: 'session' }` with
+*   the cookie already cleared.
+*
+* Inputs are validated here first, in the site's own words (`schemas` are
+* exported too, for an app that validates with its own action client). What
+* the engine still rejects comes back as `{ ok: false, reason: 'invalid',
+* message }`. Anything else is thrown, for the app's action client to turn
+* into a generic error — which is why the seam scrubs the session out of
+* every error first.
+*/
+function isOk(result) {
+	return typeof result === "object" && result !== null && "ok" in result && result.ok === true;
+}
+/** The first issue's message, for a form that has no sentence of its own. */
+function invalid(error) {
+	/* v8 ignore next -- defensive: a failed parse always carries at least one issue */
+	return {
+		ok: false,
+		reason: "invalid",
+		message: error.issues[0]?.message ?? "Invalid input"
+	};
+}
+/** The schemas the actions validate with, for an app's own action client. */
+function createPortalSchemas(rt) {
+	const { messages, phone } = rt;
+	const nameField = z.string().trim().min(1).max(60);
+	/**
+	* The same rule the wizard applies on the details step, normalised the same
+	* way, so a parent who books with one spelling and edits with another stays
+	* one contact. `''` clears.
+	*/
+	const phoneField = z.string().transform((value, ctx) => {
+		const trimmed = value.trim();
+		if (trimmed === "") return null;
+		if (!phone.looksValid(trimmed)) {
+			ctx.addIssue({
+				code: "custom",
+				message: messages.invalidPhone
+			});
+			return z.NEVER;
+		}
+		return phone.nationalDigits(trimmed);
+	});
+	/** Whole, plausible years. */
+	const birthYearField = z.number().int().refine((year) => year >= 1900 && year <= (/* @__PURE__ */ new Date()).getFullYear(), { message: messages.invalidBirthYear });
+	const personFields = z.object({
+		name: nameField,
+		birth_year: birthYearField,
+		birth_month: z.number().int().min(1).max(12).nullable().optional(),
+		notes: z.string().trim().max(500).nullable().optional(),
+		preferred_resource_id: z.string().regex(/^[\w-]{1,64}$/).nullable().optional()
+	});
+	/** Which child: the id wherever the profile named one, else the index. */
+	const personTarget = z.object({
+		person_id: z.string().min(1).max(64).nullable().optional(),
+		index: z.number().int().min(0).max(19).optional()
+	});
+	return {
+		startLogin: z.object({ email: emailField }),
+		verifyLogin: verifyLoginInput,
+		updateProfile: z.object({
+			first_name: nameField.optional(),
+			last_name: nameField.optional(),
+			phone: z.union([z.null(), phoneField]).optional(),
+			family: z.array(z.object({
+				name: nameField,
+				birth_year: birthYearField
+			})).max(10).optional()
+		}),
+		createPerson: z.object({ person: personFields }),
+		updatePerson: personTarget.extend({ person: personFields }),
+		savePerson: personTarget.extend({
+			person: personFields,
+			create: z.boolean()
+		}),
+		removePerson: personTarget,
+		setMarketingConsent: z.object({ granted: z.boolean() }),
+		deleteMe: z.object({ confirm: z.literal(rt.options.portal?.deleteConfirmWord ?? "SLETT") })
+	};
+}
+/** An empty string is «cleared» for the optional text fields (absent is the caller's). */
+function blankIsNull(value) {
+	return value === null || value === "" ? null : value;
+}
+function createPortalActions(rt) {
+	const schemas = createPortalSchemas(rt);
+	const { portal, session: jar, vippsLink, nextPath } = rt;
+	const configuredLocale = rt.options.portal?.locale;
+	const locale = configuredLocale ?? "no";
+	const portalPath = rt.paths.portal ?? rt.config.paths.booking;
+	/**
+	* Run `fn` with the parent's session, or say why not. No cookie and a
+	* cookie Medal refuses are one answer, and both clear the cookie. When `fn`
+	* comes back `{ ok: true }`, Medal has just slid the session and the cookie
+	* is renewed to match — never for a delete (which clears it) or an export.
+	*/
+	async function withPortalSession(fn, { renew = true } = {}) {
+		const session = await jar.readPortalSession();
+		if (session === null) {
+			await jar.clearPortalSession();
+			return {
+				ok: false,
+				reason: "session"
+			};
+		}
+		try {
+			const result = await fn(session);
+			if (renew && isOk(result)) await jar.renewPortalSession(session);
+			return result;
+		} catch (error) {
+			if (error instanceof PortalSessionExpiredError) {
+				await jar.clearPortalSession();
+				return {
+					ok: false,
+					reason: "session"
+				};
+			}
+			throw error;
+		}
+	}
+	/** The origin this request arrived on, for an absolute return URL. */
+	async function requestOrigin() {
+		return originFromHeaders(await headers(), rt.baseUrl() ?? "");
+	}
+	function personAnswer(result) {
+		revalidatePath(portalPath);
+		return {
+			ok: true,
+			profile: result.profile,
+			personId: result.personId,
+			fallback: result.fallback
+		};
+	}
+	async function asPersonAction(run) {
+		return withPortalSession(async (session) => {
+			try {
+				return personAnswer(await run(session));
+			} catch (error) {
+				if (error instanceof PortalValidationError) return {
+					ok: false,
+					reason: "invalid",
+					message: error.message
+				};
+				throw error;
+			}
+		});
+	}
+	function personInput(person) {
+		return {
+			name: person.name,
+			birthYear: person.birth_year,
+			...person.birth_month === void 0 ? {} : { birthMonth: person.birth_month },
+			...person.notes === void 0 ? {} : { notes: blankIsNull(person.notes) },
+			...person.preferred_resource_id === void 0 ? {} : { preferredResourceId: blankIsNull(person.preferred_resource_id) }
+		};
+	}
+	return {
+		/**
+		* Ask for a code. Always «sent» — including when Medal is throttling this
+		* address: a different answer would let anyone confirm which parents are
+		* customers by asking a few times.
+		*/
+		async startLogin(input) {
+			const parsed = schemas.startLogin.safeParse(input);
+			if (!parsed.success) return invalid(parsed.error);
+			try {
+				await (configuredLocale === void 0 ? portal.startLogin(parsed.data.email) : portal.startLogin(parsed.data.email, configuredLocale));
+			} catch (error) {
+				if (!(error instanceof PortalThrottledError)) throw error;
+			}
+			return { status: "sent" };
+		},
+		/**
+		* Exchange the code for the cookie. Prefer the `login/verify` ROUTE from
+		* the browser: an action that sets a cookie makes Next re-render the page
+		* it was called from. This is for a page that wants that.
+		*/
+		async verifyLogin(input) {
+			const parsed = schemas.verifyLogin.safeParse(input);
+			if (!parsed.success) return {
+				ok: false,
+				reason: "invalid"
+			};
+			let issued;
+			try {
+				issued = await portal.verifyLogin(parsed.data.email, parsed.data.code);
+			} catch (error) {
+				if (error instanceof PortalThrottledError) return {
+					ok: false,
+					reason: "throttled"
+				};
+				rt.logger.error(error, "Portal login code could not be verified");
+				return {
+					ok: false,
+					reason: "unreachable"
+				};
+			}
+			if (issued === null) return {
+				ok: false,
+				reason: "invalid"
+			};
+			await jar.writePortalSession(issued.sessionToken, issued.expiresAt);
+			return {
+				ok: true,
+				guardian: await rt.guardianFromSession(issued.sessionToken)
+			};
+		},
+		/**
+		* Send the parent to Vipps — the `action` of a `<form>` driven by
+		* `useActionState`, so `(previous, formData)` and the answer IS the next
+		* state; the success path never returns (`redirect()` throws, outside
+		* the `try`).
+		*
+		* The return URL is the Vipps return route on the origin the request
+		* arrived on (the canonical `baseUrl` when it names none): a preview host
+		* must not send its parents back to production. `next` is where a login
+		* that did not start on the portal should land; it is validated and kept
+		* in a cookie, written on EVERY attempt (`null` included) so a leftover
+		* destination cannot capture an ordinary login.
+		*/
+		async startVipps(_previous, formData) {
+			const next = formData?.get("next");
+			await nextPath.writePortalNextPath(typeof next === "string" ? next : null);
+			const returnUrl = new URL(rt.paths.vippsReturn, await requestOrigin()).toString();
+			const browserBinding = mintBrowserBinding();
+			await vippsLink.writeBrowserBinding(browserBinding);
+			let authorizeUrl;
+			try {
+				({authorizeUrl} = await portal.startVippsLogin({
+					returnUrl,
+					browserBinding,
+					locale
+				}));
+			} catch (error) {
+				await vippsLink.clearBrowserBinding();
+				if (error instanceof PortalThrottledError) return {
+					ok: false,
+					reason: "throttled"
+				};
+				if (!(error instanceof PortalVippsUnavailableError)) rt.logger.error(error, "Vipps login could not be started");
+				return {
+					ok: false,
+					reason: "unavailable"
+				};
+			}
+			redirect(authorizeUrl);
+		},
+		/**
+		* «Link Vipps» on the profile: send a LOGGED-IN parent to Vipps to link it
+		* to the profile they are in. The same shape as `startVipps`, with the
+		* session as the difference. A Medal without the route is `missing`.
+		*/
+		async startVippsLink(_previous, _formData) {
+			const session = await jar.readPortalSession();
+			if (session === null) return {
+				ok: false,
+				reason: "session"
+			};
+			const returnUrl = new URL(rt.paths.vippsLinkReturn, await requestOrigin()).toString();
+			const browserBinding = mintBrowserBinding();
+			await vippsLink.writeBrowserBinding(browserBinding);
+			let authorizeUrl;
+			try {
+				const started = await portal.startVippsLink(session, {
+					returnUrl,
+					browserBinding,
+					locale
+				});
+				if (started === null) {
+					await vippsLink.clearBrowserBinding();
+					return {
+						ok: false,
+						reason: "missing"
+					};
+				}
+				authorizeUrl = started.authorizeUrl;
+			} catch (error) {
+				await vippsLink.clearBrowserBinding();
+				if (error instanceof PortalSessionExpiredError) {
+					await jar.clearPortalSession();
+					return {
+						ok: false,
+						reason: "session"
+					};
+				}
+				if (error instanceof PortalThrottledError) return {
+					ok: false,
+					reason: "throttled"
+				};
+				if (!(error instanceof PortalVippsUnavailableError)) rt.logger.error(error, "Vipps link could not be started");
+				return {
+					ok: false,
+					reason: "unavailable"
+				};
+			}
+			redirect(authorizeUrl);
+		},
+		/**
+		* Log out. The cookie is cleared whatever Medal says, but only AFTER the
+		* revocation is attempted. A revocation that fails is swallowed, and not
+		* logged: the only thing worth saying about it would name the session.
+		*/
+		async logout() {
+			const session = await jar.readPortalSession();
+			if (session !== null) try {
+				await portal.logout(session);
+			} catch {}
+			await jar.clearPortalSession();
+			return { ok: true };
+		},
+		/**
+		* Edit name, phone and children. The patch carries only the keys the
+		* parent sent. Every successful write revalidates the portal page, so Back
+		* does not show the values from before the save.
+		*/
+		async updateProfile(input) {
+			const parsed = schemas.updateProfile.safeParse(input);
+			if (!parsed.success) return invalid(parsed.error);
+			return withPortalSession(async (session) => {
+				try {
+					const profile = await portal.updateMe(session, parsed.data);
+					revalidatePath(portalPath);
+					return {
+						ok: true,
+						profile
+					};
+				} catch (error) {
+					if (error instanceof PortalValidationError) return {
+						ok: false,
+						reason: "invalid",
+						message: error.message
+					};
+					throw error;
+				}
+			});
+		},
+		/** Add one child (the person endpoints, else the whole-list fallback). */
+		async createPerson(input) {
+			const parsed = schemas.createPerson.safeParse(input);
+			if (!parsed.success) return invalid(parsed.error);
+			const person = personInput(parsed.data.person);
+			return asPersonAction((session) => portal.createPerson(session, person));
+		},
+		/** Edit one child in place — the id survives a rename. */
+		async updatePerson(input) {
+			const parsed = schemas.updatePerson.safeParse(input);
+			if (!parsed.success) return invalid(parsed.error);
+			const person = personInput(parsed.data.person);
+			const target = {
+				personId: parsed.data.person_id,
+				index: parsed.data.index
+			};
+			return asPersonAction((session) => portal.updatePerson(session, target, person));
+		},
+		/** `createPerson` or `updatePerson`, by the `create` flag — one form, one action. */
+		async savePerson(input) {
+			const parsed = schemas.savePerson.safeParse(input);
+			if (!parsed.success) return invalid(parsed.error);
+			const person = personInput(parsed.data.person);
+			return asPersonAction((session) => parsed.data.create ? portal.createPerson(session, person) : portal.updatePerson(session, {
+				personId: parsed.data.person_id,
+				index: parsed.data.index
+			}, person));
+		},
+		/** Remove one child. Medal deactivates the person; its booking history stays. */
+		async removePerson(input) {
+			const parsed = schemas.removePerson.safeParse(input);
+			if (!parsed.success) return invalid(parsed.error);
+			const target = {
+				personId: parsed.data.person_id,
+				index: parsed.data.index
+			};
+			return asPersonAction((session) => portal.removePerson(session, target));
+		},
+		/**
+		* The marketing box on the profile, through the same profile patch, and
+		* echoing the STORED value so the checkbox shows what Medal has.
+		*/
+		async setMarketingConsent(input) {
+			const parsed = schemas.setMarketingConsent.safeParse(input);
+			if (!parsed.success) return invalid(parsed.error);
+			return withPortalSession(async (session) => {
+				const profile = await portal.updateMe(session, { marketing_consent: parsed.data.granted });
+				revalidatePath(portalPath);
+				return {
+					ok: true,
+					marketingConsent: profile.marketingConsent
+				};
+			});
+		},
+		/**
+		* The parent's data as a file (GDPR art. 15), pretty-printed and dated.
+		* No renewal: a cookie set by an action re-renders the page, which would
+		* hold the download behind a full dashboard render.
+		*/
+		async exportData() {
+			return withPortalSession(async (session) => {
+				const exported = await portal.exportMyData(session);
+				const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+				return {
+					ok: true,
+					filename: `${rt.options.portal?.exportFilePrefix ?? "min-side-eksport"}-${date}.json`,
+					json: JSON.stringify(exported, null, 2)
+				};
+			}, { renew: false });
+		},
+		/**
+		* Delete the account (GDPR art. 17). The confirmation word is checked
+		* here rather than trusted from a disabled button. The cookie is cleared
+		* only after Medal has said yes.
+		*/
+		async deleteMe(input) {
+			const parsed = schemas.deleteMe.safeParse(input);
+			if (!parsed.success) return invalid(parsed.error);
+			return withPortalSession(async (session) => {
+				await portal.deleteMe(session);
+				await jar.clearPortalSession();
+				return { ok: true };
+			}, { renew: false });
+		}
+	};
+}
+function createPortalFor(rt) {
+	return {
+		session: rt.session,
+		actions: createPortalActions(rt),
+		schemas: createPortalSchemas(rt),
+		vippsReturn: { GET: (request) => vippsReturnRoute(rt, request) },
+		vippsLinkReturn: { GET: (request) => vippsLinkReturnRoute(rt, request) }
+	};
+}
+//#endregion
+export { createPortalActions, createPortalFor, createPortalSchemas };
+
+//# sourceMappingURL=portal.mjs.map

package/dist/next/portal.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal.mjs","names":[],"sources":["../../src/next/portal.ts"],"sourcesContent":["/**\n * The customer portal's server half: the session cookie, the action functions\n * behind the portal's forms, and the two Vipps return routes.\n *\n * SERVER ACTIONS STAY IN THE APP. A library cannot ship `'use server'` exports\n * reliably, so these are plain async functions and the app wraps each in a\n * three-line action:\n *\n * ```ts\n * 'use server';\n * export async function updateProfileAction(input: unknown) {\n *   return booking.portal.actions.updateProfile(input);\n * }\n * ```\n *\n * The components receive the actions as props, so nothing in the package\n * imports from an app file.\n *\n * Every action keeps the same two obligations:\n *\n * - **The session never leaves the server.** It is read from the cookie\n *   inside `withPortalSession`, handed to the seam, and appears in no return\n *   value — an action's result is serialised into the browser.\n * - **A dead session is an answer, not an error.** Medal saying the cookie is\n *   no longer honoured comes back as `{ ok: false, reason: 'session' }` with\n *   the cookie already cleared.\n *\n * Inputs are validated here first, in the site's own words (`schemas` are\n * exported too, for an app that validates with its own action client). What\n * the engine still rejects comes back as `{ ok: false, reason: 'invalid',\n * message }`. Anything else is thrown, for the app's action client to turn\n * into a generic error — which is why the seam scrubs the session out of\n * every error first.\n */\n\nimport { revalidatePath } from 'next/cache';\nimport { headers } from 'next/headers';\nimport { redirect } from 'next/navigation';\nimport { z } from 'zod';\nimport type { PortalProfileDto } from '../core/portal/dto';\nimport { emailField, verifyLoginInput } from '../core/portal/login-input';\nimport { mintBrowserBinding } from '../core/portal/vipps-link';\nimport type { BookingGuardian } from '../core/types';\nimport {\n  type PortalPersonResult,\n  PortalSessionExpiredError,\n  PortalThrottledError,\n  PortalValidationError,\n  PortalVippsUnavailableError,\n} from './portal/medal-portal';\nimport { originFromHeaders } from './request';\nimport { vippsLinkReturnRoute, vippsReturnRoute } from './routes/vipps-return';\nimport type { BookingRuntime } from './runtime';\n\nexport type SessionFailure = { ok: false; reason: 'session' };\nexport type InvalidInput = { ok: false; reason: 'invalid'; message: string };\n\n/** What the Vipps button hears back when it did NOT get a redirect. */\nexport type VippsStartState = { ok: false; reason: 'unavailable' | 'throttled' } | null;\n\n/** What «link Vipps» hears back when it did NOT get a redirect. */\nexport type VippsLinkStartState = {\n  ok: false;\n  /** `missing`: this Medal has no link route — the row hides itself. */\n  reason: 'missing' | 'session' | 'unavailable' | 'throttled';\n} | null;\n\nexport type UpdateProfileResult =\n  | { ok: true; profile: PortalProfileDto }\n  | SessionFailure\n  | InvalidInput;\n\nexport type PersonActionResult =\n  | { ok: true; profile: PortalProfileDto; personId: string | null; fallback: boolean }\n  | SessionFailure\n  | InvalidInput;\n\nexport type VerifyLoginResult =\n  | { ok: true; guardian: BookingGuardian | null }\n  | { ok: false; reason: 'invalid' | 'throttled' | 'unreachable' };\n\nfunction isOk(result: unknown): boolean {\n  return typeof result === 'object' && result !== null && 'ok' in result && result.ok === true;\n}\n\n/** The first issue's message, for a form that has no sentence of its own. */\nfunction invalid(error: z.ZodError): InvalidInput {\n  /* v8 ignore next -- defensive: a failed parse always carries at least one issue */\n  return { ok: false, reason: 'invalid', message: error.issues[0]?.message ?? 'Invalid input' };\n}\n\n/** The schemas the actions validate with, for an app's own action client. */\nexport function createPortalSchemas(rt: BookingRuntime) {\n  const { messages, phone } = rt;\n  const nameField = z.string().trim().min(1).max(60);\n\n  /**\n   * The same rule the wizard applies on the details step, normalised the same\n   * way, so a parent who books with one spelling and edits with another stays\n   * one contact. `''` clears.\n   */\n  const phoneField = z.string().transform((value, ctx) => {\n    const trimmed = value.trim();\n    if (trimmed === '') return null;\n    if (!phone.looksValid(trimmed)) {\n      ctx.addIssue({ code: 'custom', message: messages.invalidPhone });\n      return z.NEVER;\n    }\n    return phone.nationalDigits(trimmed);\n  });\n\n  /** Whole, plausible years. */\n  const birthYearField = z\n    .number()\n    .int()\n    .refine((year) => year >= 1900 && year <= new Date().getFullYear(), {\n      message: messages.invalidBirthYear,\n    });\n\n  const personFields = z.object({\n    name: nameField,\n    birth_year: birthYearField,\n    birth_month: z.number().int().min(1).max(12).nullable().optional(),\n    notes: z.string().trim().max(500).nullable().optional(),\n    preferred_resource_id: z\n      .string()\n      .regex(/^[\\w-]{1,64}$/)\n      .nullable()\n      .optional(),\n  });\n\n  /** Which child: the id wherever the profile named one, else the index. */\n  const personTarget = z.object({\n    person_id: z.string().min(1).max(64).nullable().optional(),\n    index: z.number().int().min(0).max(19).optional(),\n  });\n\n  return {\n    startLogin: z.object({ email: emailField }),\n    verifyLogin: verifyLoginInput,\n    updateProfile: z.object({\n      first_name: nameField.optional(),\n      last_name: nameField.optional(),\n      phone: z.union([z.null(), phoneField]).optional(),\n      family: z\n        .array(z.object({ name: nameField, birth_year: birthYearField }))\n        .max(10)\n        .optional(),\n    }),\n    createPerson: z.object({ person: personFields }),\n    updatePerson: personTarget.extend({ person: personFields }),\n    savePerson: personTarget.extend({ person: personFields, create: z.boolean() }),\n    removePerson: personTarget,\n    setMarketingConsent: z.object({ granted: z.boolean() }),\n    deleteMe: z.object({ confirm: z.literal(rt.options.portal?.deleteConfirmWord ?? 'SLETT') }),\n  };\n}\n\nexport type PortalSchemas = ReturnType<typeof createPortalSchemas>;\n\n/** An empty string is «cleared» for the optional text fields (absent is the caller's). */\nfunction blankIsNull(value: string | null): string | null {\n  return value === null || value === '' ? null : value;\n}\n\nexport function createPortalActions(rt: BookingRuntime) {\n  const schemas = createPortalSchemas(rt);\n  const { portal, session: jar, vippsLink, nextPath } = rt;\n  const configuredLocale = rt.options.portal?.locale;\n  const locale = configuredLocale ?? 'no';\n  const portalPath = rt.paths.portal ?? rt.config.paths.booking;\n\n  /**\n   * Run `fn` with the parent's session, or say why not. No cookie and a\n   * cookie Medal refuses are one answer, and both clear the cookie. When `fn`\n   * comes back `{ ok: true }`, Medal has just slid the session and the cookie\n   * is renewed to match — never for a delete (which clears it) or an export.\n   */\n  async function withPortalSession<T>(\n    fn: (session: string) => Promise<T>,\n    { renew = true }: { renew?: boolean } = {}\n  ): Promise<T | SessionFailure> {\n    const session = await jar.readPortalSession();\n    if (session === null) {\n      await jar.clearPortalSession();\n      return { ok: false, reason: 'session' };\n    }\n    try {\n      const result = await fn(session);\n      if (renew && isOk(result)) await jar.renewPortalSession(session);\n      return result;\n    } catch (error) {\n      if (error instanceof PortalSessionExpiredError) {\n        await jar.clearPortalSession();\n        return { ok: false, reason: 'session' };\n      }\n      throw error;\n    }\n  }\n\n  /** The origin this request arrived on, for an absolute return URL. */\n  async function requestOrigin(): Promise<string> {\n    return originFromHeaders(await headers(), rt.baseUrl() ?? '');\n  }\n\n  function personAnswer(result: PortalPersonResult): PersonActionResult {\n    revalidatePath(portalPath);\n    return {\n      ok: true as const,\n      profile: result.profile,\n      personId: result.personId,\n      fallback: result.fallback,\n    };\n  }\n\n  async function asPersonAction(\n    run: (session: string) => Promise<PortalPersonResult>\n  ): Promise<PersonActionResult> {\n    return withPortalSession(async (session) => {\n      try {\n        return personAnswer(await run(session));\n      } catch (error) {\n        if (error instanceof PortalValidationError) {\n          return { ok: false as const, reason: 'invalid' as const, message: error.message };\n        }\n        throw error;\n      }\n    });\n  }\n\n  function personInput(person: z.infer<PortalSchemas['createPerson']>['person']) {\n    return {\n      name: person.name,\n      birthYear: person.birth_year,\n      ...(person.birth_month === undefined ? {} : { birthMonth: person.birth_month }),\n      ...(person.notes === undefined ? {} : { notes: blankIsNull(person.notes) }),\n      ...(person.preferred_resource_id === undefined\n        ? {}\n        : { preferredResourceId: blankIsNull(person.preferred_resource_id) }),\n    };\n  }\n\n  return {\n    /**\n     * Ask for a code. Always «sent» — including when Medal is throttling this\n     * address: a different answer would let anyone confirm which parents are\n     * customers by asking a few times.\n     */\n    async startLogin(input: unknown): Promise<{ status: 'sent' } | InvalidInput> {\n      const parsed = schemas.startLogin.safeParse(input);\n      if (!parsed.success) return invalid(parsed.error);\n      try {\n        // The seam's own default when the site names no locale, as before the move.\n        await (configuredLocale === undefined\n          ? portal.startLogin(parsed.data.email)\n          : portal.startLogin(parsed.data.email, configuredLocale));\n      } catch (error) {\n        if (!(error instanceof PortalThrottledError)) throw error;\n      }\n      return { status: 'sent' as const };\n    },\n\n    /**\n     * Exchange the code for the cookie. Prefer the `login/verify` ROUTE from\n     * the browser: an action that sets a cookie makes Next re-render the page\n     * it was called from. This is for a page that wants that.\n     */\n    async verifyLogin(input: unknown): Promise<VerifyLoginResult> {\n      const parsed = schemas.verifyLogin.safeParse(input);\n      if (!parsed.success) return { ok: false, reason: 'invalid' };\n      let issued: Awaited<ReturnType<typeof portal.verifyLogin>>;\n      try {\n        issued = await portal.verifyLogin(parsed.data.email, parsed.data.code);\n      } catch (error) {\n        if (error instanceof PortalThrottledError) return { ok: false, reason: 'throttled' };\n        rt.logger.error(error, 'Portal login code could not be verified');\n        return { ok: false, reason: 'unreachable' };\n      }\n      if (issued === null) return { ok: false, reason: 'invalid' };\n      await jar.writePortalSession(issued.sessionToken, issued.expiresAt);\n      return { ok: true, guardian: await rt.guardianFromSession(issued.sessionToken) };\n    },\n\n    /**\n     * Send the parent to Vipps — the `action` of a `<form>` driven by\n     * `useActionState`, so `(previous, formData)` and the answer IS the next\n     * state; the success path never returns (`redirect()` throws, outside\n     * the `try`).\n     *\n     * The return URL is the Vipps return route on the origin the request\n     * arrived on (the canonical `baseUrl` when it names none): a preview host\n     * must not send its parents back to production. `next` is where a login\n     * that did not start on the portal should land; it is validated and kept\n     * in a cookie, written on EVERY attempt (`null` included) so a leftover\n     * destination cannot capture an ordinary login.\n     */\n    async startVipps(_previous: VippsStartState, formData?: FormData): Promise<VippsStartState> {\n      const next = formData?.get('next');\n      await nextPath.writePortalNextPath(typeof next === 'string' ? next : null);\n      const returnUrl = new URL(rt.paths.vippsReturn, await requestOrigin()).toString();\n      // This browser's binding for a pending link Medal may offer — minted per\n      // attempt, kept in an httpOnly cookie, never in a URL.\n      const browserBinding = mintBrowserBinding();\n      await vippsLink.writeBrowserBinding(browserBinding);\n      let authorizeUrl: string;\n      try {\n        ({ authorizeUrl } = await portal.startVippsLogin({ returnUrl, browserBinding, locale }));\n      } catch (error) {\n        // No login went out, so no callback will ever spend this binding.\n        await vippsLink.clearBrowserBinding();\n        if (error instanceof PortalThrottledError) return { ok: false, reason: 'throttled' };\n        if (!(error instanceof PortalVippsUnavailableError)) {\n          rt.logger.error(error, 'Vipps login could not be started');\n        }\n        return { ok: false, reason: 'unavailable' };\n      }\n      redirect(authorizeUrl);\n    },\n\n    /**\n     * «Link Vipps» on the profile: send a LOGGED-IN parent to Vipps to link it\n     * to the profile they are in. The same shape as `startVipps`, with the\n     * session as the difference. A Medal without the route is `missing`.\n     */\n    async startVippsLink(\n      _previous: VippsLinkStartState,\n      _formData?: FormData\n    ): Promise<VippsLinkStartState> {\n      const session = await jar.readPortalSession();\n      if (session === null) return { ok: false, reason: 'session' };\n      const returnUrl = new URL(rt.paths.vippsLinkReturn, await requestOrigin()).toString();\n      const browserBinding = mintBrowserBinding();\n      await vippsLink.writeBrowserBinding(browserBinding);\n      let authorizeUrl: string;\n      try {\n        const started = await portal.startVippsLink(session, {\n          returnUrl,\n          browserBinding,\n          locale,\n        });\n        if (started === null) {\n          await vippsLink.clearBrowserBinding();\n          return { ok: false, reason: 'missing' };\n        }\n        authorizeUrl = started.authorizeUrl;\n      } catch (error) {\n        await vippsLink.clearBrowserBinding();\n        if (error instanceof PortalSessionExpiredError) {\n          await jar.clearPortalSession();\n          return { ok: false, reason: 'session' };\n        }\n        if (error instanceof PortalThrottledError) return { ok: false, reason: 'throttled' };\n        if (!(error instanceof PortalVippsUnavailableError)) {\n          rt.logger.error(error, 'Vipps link could not be started');\n        }\n        return { ok: false, reason: 'unavailable' };\n      }\n      redirect(authorizeUrl);\n    },\n\n    /**\n     * Log out. The cookie is cleared whatever Medal says, but only AFTER the\n     * revocation is attempted. A revocation that fails is swallowed, and not\n     * logged: the only thing worth saying about it would name the session.\n     */\n    async logout(): Promise<{ ok: true }> {\n      const session = await jar.readPortalSession();\n      if (session !== null) {\n        try {\n          await portal.logout(session);\n        } catch {\n          // Swallowed on purpose; see above.\n        }\n      }\n      await jar.clearPortalSession();\n      return { ok: true as const };\n    },\n\n    /**\n     * Edit name, phone and children. The patch carries only the keys the\n     * parent sent. Every successful write revalidates the portal page, so Back\n     * does not show the values from before the save.\n     */\n    async updateProfile(input: unknown): Promise<UpdateProfileResult> {\n      const parsed = schemas.updateProfile.safeParse(input);\n      if (!parsed.success) return invalid(parsed.error);\n      return withPortalSession(async (session) => {\n        try {\n          const profile = await portal.updateMe(session, parsed.data);\n          revalidatePath(portalPath);\n          return { ok: true as const, profile };\n        } catch (error) {\n          if (error instanceof PortalValidationError) {\n            return { ok: false as const, reason: 'invalid' as const, message: error.message };\n          }\n          throw error;\n        }\n      });\n    },\n\n    /** Add one child (the person endpoints, else the whole-list fallback). */\n    async createPerson(input: unknown): Promise<PersonActionResult> {\n      const parsed = schemas.createPerson.safeParse(input);\n      if (!parsed.success) return invalid(parsed.error);\n      const person = personInput(parsed.data.person);\n      return asPersonAction((session) => portal.createPerson(session, person));\n    },\n\n    /** Edit one child in place — the id survives a rename. */\n    async updatePerson(input: unknown): Promise<PersonActionResult> {\n      const parsed = schemas.updatePerson.safeParse(input);\n      if (!parsed.success) return invalid(parsed.error);\n      const person = personInput(parsed.data.person);\n      const target = { personId: parsed.data.person_id, index: parsed.data.index };\n      return asPersonAction((session) => portal.updatePerson(session, target, person));\n    },\n\n    /** `createPerson` or `updatePerson`, by the `create` flag — one form, one action. */\n    async savePerson(input: unknown): Promise<PersonActionResult> {\n      const parsed = schemas.savePerson.safeParse(input);\n      if (!parsed.success) return invalid(parsed.error);\n      const person = personInput(parsed.data.person);\n      return asPersonAction((session) =>\n        parsed.data.create\n          ? portal.createPerson(session, person)\n          : portal.updatePerson(\n              session,\n              { personId: parsed.data.person_id, index: parsed.data.index },\n              person\n            )\n      );\n    },\n\n    /** Remove one child. Medal deactivates the person; its booking history stays. */\n    async removePerson(input: unknown): Promise<PersonActionResult> {\n      const parsed = schemas.removePerson.safeParse(input);\n      if (!parsed.success) return invalid(parsed.error);\n      const target = { personId: parsed.data.person_id, index: parsed.data.index };\n      return asPersonAction((session) => portal.removePerson(session, target));\n    },\n\n    /**\n     * The marketing box on the profile, through the same profile patch, and\n     * echoing the STORED value so the checkbox shows what Medal has.\n     */\n    async setMarketingConsent(\n      input: unknown\n    ): Promise<{ ok: true; marketingConsent: boolean } | SessionFailure | InvalidInput> {\n      const parsed = schemas.setMarketingConsent.safeParse(input);\n      if (!parsed.success) return invalid(parsed.error);\n      return withPortalSession(async (session) => {\n        const profile = await portal.updateMe(session, {\n          marketing_consent: parsed.data.granted,\n        });\n        revalidatePath(portalPath);\n        return { ok: true as const, marketingConsent: profile.marketingConsent };\n      });\n    },\n\n    /**\n     * The parent's data as a file (GDPR art. 15), pretty-printed and dated.\n     * No renewal: a cookie set by an action re-renders the page, which would\n     * hold the download behind a full dashboard render.\n     */\n    async exportData(): Promise<{ ok: true; filename: string; json: string } | SessionFailure> {\n      return withPortalSession(\n        async (session) => {\n          const exported = await portal.exportMyData(session);\n          const date = new Date().toISOString().slice(0, 10);\n          return {\n            ok: true as const,\n            filename: `${rt.options.portal?.exportFilePrefix ?? 'min-side-eksport'}-${date}.json`,\n            json: JSON.stringify(exported, null, 2),\n          };\n        },\n        { renew: false }\n      );\n    },\n\n    /**\n     * Delete the account (GDPR art. 17). The confirmation word is checked\n     * here rather than trusted from a disabled button. The cookie is cleared\n     * only after Medal has said yes.\n     */\n    async deleteMe(input: unknown): Promise<{ ok: true } | SessionFailure | InvalidInput> {\n      const parsed = schemas.deleteMe.safeParse(input);\n      if (!parsed.success) return invalid(parsed.error);\n      return withPortalSession(\n        async (session) => {\n          await portal.deleteMe(session);\n          await jar.clearPortalSession();\n          return { ok: true as const };\n        },\n        { renew: false }\n      );\n    },\n  };\n}\n\nexport type PortalActions = ReturnType<typeof createPortalActions>;\n\nexport interface Portal {\n  /** The session cookie, for a page or route of the app's own. */\n  session: BookingRuntime['session'];\n  actions: PortalActions;\n  schemas: PortalSchemas;\n  /** `GET` for the Vipps login return route (`portal.vippsReturnPath`). */\n  vippsReturn: { GET(request: Request): Promise<Response> };\n  /** `GET` for the «link Vipps» return route (`portal.vippsLinkReturnPath`). */\n  vippsLinkReturn: { GET(request: Request): Promise<Response> };\n}\n\nexport function createPortalFor(rt: BookingRuntime): Portal {\n  return {\n    session: rt.session,\n    actions: createPortalActions(rt),\n    schemas: createPortalSchemas(rt),\n    vippsReturn: { GET: (request) => vippsReturnRoute(rt, request) },\n    vippsLinkReturn: { GET: (request) => vippsLinkReturnRoute(rt, request) },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFA,SAAS,KAAK,QAA0B;CACtC,OAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,QAAQ,UAAU,OAAO,OAAO;AAC1F;;AAGA,SAAS,QAAQ,OAAiC;;CAEhD,OAAO;EAAE,IAAI;EAAO,QAAQ;EAAW,SAAS,MAAM,OAAO,EAAE,EAAE,WAAW;CAAgB;AAC9F;;AAGA,SAAgB,oBAAoB,IAAoB;CACtD,MAAM,EAAE,UAAU,UAAU;CAC5B,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;;;;;;CAOjD,MAAM,aAAa,EAAE,OAAO,CAAC,CAAC,WAAW,OAAO,QAAQ;EACtD,MAAM,UAAU,MAAM,KAAK;EAC3B,IAAI,YAAY,IAAI,OAAO;EAC3B,IAAI,CAAC,MAAM,WAAW,OAAO,GAAG;GAC9B,IAAI,SAAS;IAAE,MAAM;IAAU,SAAS,SAAS;GAAa,CAAC;GAC/D,OAAO,EAAE;EACX;EACA,OAAO,MAAM,eAAe,OAAO;CACrC,CAAC;;CAGD,MAAM,iBAAiB,EACpB,OAAO,CAAC,CACR,IAAI,CAAC,CACL,QAAQ,SAAS,QAAQ,QAAQ,yBAAQ,IAAI,KAAK,EAAA,CAAE,YAAY,GAAG,EAClE,SAAS,SAAS,iBACpB,CAAC;CAEH,MAAM,eAAe,EAAE,OAAO;EAC5B,MAAM;EACN,YAAY;EACZ,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACjE,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACtD,uBAAuB,EACpB,OAAO,CAAC,CACR,MAAM,eAAe,CAAC,CACtB,SAAS,CAAC,CACV,SAAS;CACd,CAAC;;CAGD,MAAM,eAAe,EAAE,OAAO;EAC5B,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACzD,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;CAClD,CAAC;CAED,OAAO;EACL,YAAY,EAAE,OAAO,EAAE,OAAO,WAAW,CAAC;EAC1C,aAAa;EACb,eAAe,EAAE,OAAO;GACtB,YAAY,UAAU,SAAS;GAC/B,WAAW,UAAU,SAAS;GAC9B,OAAO,EAAE,MAAM,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS;GAChD,QAAQ,EACL,MAAM,EAAE,OAAO;IAAE,MAAM;IAAW,YAAY;GAAe,CAAC,CAAC,CAAC,CAChE,IAAI,EAAE,CAAC,CACP,SAAS;EACd,CAAC;EACD,cAAc,EAAE,OAAO,EAAE,QAAQ,aAAa,CAAC;EAC/C,cAAc,aAAa,OAAO,EAAE,QAAQ,aAAa,CAAC;EAC1D,YAAY,aAAa,OAAO;GAAE,QAAQ;GAAc,QAAQ,EAAE,QAAQ;EAAE,CAAC;EAC7E,cAAc;EACd,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;EACtD,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAG,QAAQ,QAAQ,qBAAqB,OAAO,EAAE,CAAC;CAC5F;AACF;;AAKA,SAAS,YAAY,OAAqC;CACxD,OAAO,UAAU,QAAQ,UAAU,KAAK,OAAO;AACjD;AAEA,SAAgB,oBAAoB,IAAoB;CACtD,MAAM,UAAU,oBAAoB,EAAE;CACtC,MAAM,EAAE,QAAQ,SAAS,KAAK,WAAW,aAAa;CACtD,MAAM,mBAAmB,GAAG,QAAQ,QAAQ;CAC5C,MAAM,SAAS,oBAAoB;CACnC,MAAM,aAAa,GAAG,MAAM,UAAU,GAAG,OAAO,MAAM;;;;;;;CAQtD,eAAe,kBACb,IACA,EAAE,QAAQ,SAA8B,CAAC,GACZ;EAC7B,MAAM,UAAU,MAAM,IAAI,kBAAkB;EAC5C,IAAI,YAAY,MAAM;GACpB,MAAM,IAAI,mBAAmB;GAC7B,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAU;EACxC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,OAAO;GAC/B,IAAI,SAAS,KAAK,MAAM,GAAG,MAAM,IAAI,mBAAmB,OAAO;GAC/D,OAAO;EACT,SAAS,OAAO;GACd,IAAI,iBAAiB,2BAA2B;IAC9C,MAAM,IAAI,mBAAmB;IAC7B,OAAO;KAAE,IAAI;KAAO,QAAQ;IAAU;GACxC;GACA,MAAM;EACR;CACF;;CAGA,eAAe,gBAAiC;EAC9C,OAAO,kBAAkB,MAAM,QAAQ,GAAG,GAAG,QAAQ,KAAK,EAAE;CAC9D;CAEA,SAAS,aAAa,QAAgD;EACpE,eAAe,UAAU;EACzB,OAAO;GACL,IAAI;GACJ,SAAS,OAAO;GAChB,UAAU,OAAO;GACjB,UAAU,OAAO;EACnB;CACF;CAEA,eAAe,eACb,KAC6B;EAC7B,OAAO,kBAAkB,OAAO,YAAY;GAC1C,IAAI;IACF,OAAO,aAAa,MAAM,IAAI,OAAO,CAAC;GACxC,SAAS,OAAO;IACd,IAAI,iBAAiB,uBACnB,OAAO;KAAE,IAAI;KAAgB,QAAQ;KAAoB,SAAS,MAAM;IAAQ;IAElF,MAAM;GACR;EACF,CAAC;CACH;CAEA,SAAS,YAAY,QAA0D;EAC7E,OAAO;GACL,MAAM,OAAO;GACb,WAAW,OAAO;GAClB,GAAI,OAAO,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY,OAAO,YAAY;GAC7E,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,YAAY,OAAO,KAAK,EAAE;GACzE,GAAI,OAAO,0BAA0B,KAAA,IACjC,CAAC,IACD,EAAE,qBAAqB,YAAY,OAAO,qBAAqB,EAAE;EACvE;CACF;CAEA,OAAO;;;;;;EAML,MAAM,WAAW,OAA4D;GAC3E,MAAM,SAAS,QAAQ,WAAW,UAAU,KAAK;GACjD,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,OAAO,KAAK;GAChD,IAAI;IAEF,OAAO,qBAAqB,KAAA,IACxB,OAAO,WAAW,OAAO,KAAK,KAAK,IACnC,OAAO,WAAW,OAAO,KAAK,OAAO,gBAAgB;GAC3D,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiB,uBAAuB,MAAM;GACtD;GACA,OAAO,EAAE,QAAQ,OAAgB;EACnC;;;;;;EAOA,MAAM,YAAY,OAA4C;GAC5D,MAAM,SAAS,QAAQ,YAAY,UAAU,KAAK;GAClD,IAAI,CAAC,OAAO,SAAS,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAU;GAC3D,IAAI;GACJ,IAAI;IACF,SAAS,MAAM,OAAO,YAAY,OAAO,KAAK,OAAO,OAAO,KAAK,IAAI;GACvE,SAAS,OAAO;IACd,IAAI,iBAAiB,sBAAsB,OAAO;KAAE,IAAI;KAAO,QAAQ;IAAY;IACnF,GAAG,OAAO,MAAM,OAAO,yCAAyC;IAChE,OAAO;KAAE,IAAI;KAAO,QAAQ;IAAc;GAC5C;GACA,IAAI,WAAW,MAAM,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAU;GAC3D,MAAM,IAAI,mBAAmB,OAAO,cAAc,OAAO,SAAS;GAClE,OAAO;IAAE,IAAI;IAAM,UAAU,MAAM,GAAG,oBAAoB,OAAO,YAAY;GAAE;EACjF;;;;;;;;;;;;;;EAeA,MAAM,WAAW,WAA4B,UAA+C;GAC1F,MAAM,OAAO,UAAU,IAAI,MAAM;GACjC,MAAM,SAAS,oBAAoB,OAAO,SAAS,WAAW,OAAO,IAAI;GACzE,MAAM,YAAY,IAAI,IAAI,GAAG,MAAM,aAAa,MAAM,cAAc,CAAC,CAAC,CAAC,SAAS;GAGhF,MAAM,iBAAiB,mBAAmB;GAC1C,MAAM,UAAU,oBAAoB,cAAc;GAClD,IAAI;GACJ,IAAI;IACF,CAAC,CAAE,gBAAiB,MAAM,OAAO,gBAAgB;KAAE;KAAW;KAAgB;IAAO,CAAC;GACxF,SAAS,OAAO;IAEd,MAAM,UAAU,oBAAoB;IACpC,IAAI,iBAAiB,sBAAsB,OAAO;KAAE,IAAI;KAAO,QAAQ;IAAY;IACnF,IAAI,EAAE,iBAAiB,8BACrB,GAAG,OAAO,MAAM,OAAO,kCAAkC;IAE3D,OAAO;KAAE,IAAI;KAAO,QAAQ;IAAc;GAC5C;GACA,SAAS,YAAY;EACvB;;;;;;EAOA,MAAM,eACJ,WACA,WAC8B;GAC9B,MAAM,UAAU,MAAM,IAAI,kBAAkB;GAC5C,IAAI,YAAY,MAAM,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAU;GAC5D,MAAM,YAAY,IAAI,IAAI,GAAG,MAAM,iBAAiB,MAAM,cAAc,CAAC,CAAC,CAAC,SAAS;GACpF,MAAM,iBAAiB,mBAAmB;GAC1C,MAAM,UAAU,oBAAoB,cAAc;GAClD,IAAI;GACJ,IAAI;IACF,MAAM,UAAU,MAAM,OAAO,eAAe,SAAS;KACnD;KACA;KACA;IACF,CAAC;IACD,IAAI,YAAY,MAAM;KACpB,MAAM,UAAU,oBAAoB;KACpC,OAAO;MAAE,IAAI;MAAO,QAAQ;KAAU;IACxC;IACA,eAAe,QAAQ;GACzB,SAAS,OAAO;IACd,MAAM,UAAU,oBAAoB;IACpC,IAAI,iBAAiB,2BAA2B;KAC9C,MAAM,IAAI,mBAAmB;KAC7B,OAAO;MAAE,IAAI;MAAO,QAAQ;KAAU;IACxC;IACA,IAAI,iBAAiB,sBAAsB,OAAO;KAAE,IAAI;KAAO,QAAQ;IAAY;IACnF,IAAI,EAAE,iBAAiB,8BACrB,GAAG,OAAO,MAAM,OAAO,iCAAiC;IAE1D,OAAO;KAAE,IAAI;KAAO,QAAQ;IAAc;GAC5C;GACA,SAAS,YAAY;EACvB;;;;;;EAOA,MAAM,SAAgC;GACpC,MAAM,UAAU,MAAM,IAAI,kBAAkB;GAC5C,IAAI,YAAY,MACd,IAAI;IACF,MAAM,OAAO,OAAO,OAAO;GAC7B,QAAQ,CAER;GAEF,MAAM,IAAI,mBAAmB;GAC7B,OAAO,EAAE,IAAI,KAAc;EAC7B;;;;;;EAOA,MAAM,cAAc,OAA8C;GAChE,MAAM,SAAS,QAAQ,cAAc,UAAU,KAAK;GACpD,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,OAAO,KAAK;GAChD,OAAO,kBAAkB,OAAO,YAAY;IAC1C,IAAI;KACF,MAAM,UAAU,MAAM,OAAO,SAAS,SAAS,OAAO,IAAI;KAC1D,eAAe,UAAU;KACzB,OAAO;MAAE,IAAI;MAAe;KAAQ;IACtC,SAAS,OAAO;KACd,IAAI,iBAAiB,uBACnB,OAAO;MAAE,IAAI;MAAgB,QAAQ;MAAoB,SAAS,MAAM;KAAQ;KAElF,MAAM;IACR;GACF,CAAC;EACH;;EAGA,MAAM,aAAa,OAA6C;GAC9D,MAAM,SAAS,QAAQ,aAAa,UAAU,KAAK;GACnD,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,OAAO,KAAK;GAChD,MAAM,SAAS,YAAY,OAAO,KAAK,MAAM;GAC7C,OAAO,gBAAgB,YAAY,OAAO,aAAa,SAAS,MAAM,CAAC;EACzE;;EAGA,MAAM,aAAa,OAA6C;GAC9D,MAAM,SAAS,QAAQ,aAAa,UAAU,KAAK;GACnD,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,OAAO,KAAK;GAChD,MAAM,SAAS,YAAY,OAAO,KAAK,MAAM;GAC7C,MAAM,SAAS;IAAE,UAAU,OAAO,KAAK;IAAW,OAAO,OAAO,KAAK;GAAM;GAC3E,OAAO,gBAAgB,YAAY,OAAO,aAAa,SAAS,QAAQ,MAAM,CAAC;EACjF;;EAGA,MAAM,WAAW,OAA6C;GAC5D,MAAM,SAAS,QAAQ,WAAW,UAAU,KAAK;GACjD,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,OAAO,KAAK;GAChD,MAAM,SAAS,YAAY,OAAO,KAAK,MAAM;GAC7C,OAAO,gBAAgB,YACrB,OAAO,KAAK,SACR,OAAO,aAAa,SAAS,MAAM,IACnC,OAAO,aACL,SACA;IAAE,UAAU,OAAO,KAAK;IAAW,OAAO,OAAO,KAAK;GAAM,GAC5D,MACF,CACN;EACF;;EAGA,MAAM,aAAa,OAA6C;GAC9D,MAAM,SAAS,QAAQ,aAAa,UAAU,KAAK;GACnD,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,OAAO,KAAK;GAChD,MAAM,SAAS;IAAE,UAAU,OAAO,KAAK;IAAW,OAAO,OAAO,KAAK;GAAM;GAC3E,OAAO,gBAAgB,YAAY,OAAO,aAAa,SAAS,MAAM,CAAC;EACzE;;;;;EAMA,MAAM,oBACJ,OACkF;GAClF,MAAM,SAAS,QAAQ,oBAAoB,UAAU,KAAK;GAC1D,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,OAAO,KAAK;GAChD,OAAO,kBAAkB,OAAO,YAAY;IAC1C,MAAM,UAAU,MAAM,OAAO,SAAS,SAAS,EAC7C,mBAAmB,OAAO,KAAK,QACjC,CAAC;IACD,eAAe,UAAU;IACzB,OAAO;KAAE,IAAI;KAAe,kBAAkB,QAAQ;IAAiB;GACzE,CAAC;EACH;;;;;;EAOA,MAAM,aAAqF;GACzF,OAAO,kBACL,OAAO,YAAY;IACjB,MAAM,WAAW,MAAM,OAAO,aAAa,OAAO;IAClD,MAAM,wBAAO,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE;IACjD,OAAO;KACL,IAAI;KACJ,UAAU,GAAG,GAAG,QAAQ,QAAQ,oBAAoB,mBAAmB,GAAG,KAAK;KAC/E,MAAM,KAAK,UAAU,UAAU,MAAM,CAAC;IACxC;GACF,GACA,EAAE,OAAO,MAAM,CACjB;EACF;;;;;;EAOA,MAAM,SAAS,OAAuE;GACpF,MAAM,SAAS,QAAQ,SAAS,UAAU,KAAK;GAC/C,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,OAAO,KAAK;GAChD,OAAO,kBACL,OAAO,YAAY;IACjB,MAAM,OAAO,SAAS,OAAO;IAC7B,MAAM,IAAI,mBAAmB;IAC7B,OAAO,EAAE,IAAI,KAAc;GAC7B,GACA,EAAE,OAAO,MAAM,CACjB;EACF;CACF;AACF;AAeA,SAAgB,gBAAgB,IAA4B;CAC1D,OAAO;EACL,SAAS,GAAG;EACZ,SAAS,oBAAoB,EAAE;EAC/B,SAAS,oBAAoB,EAAE;EAC/B,aAAa,EAAE,MAAM,YAAY,iBAAiB,IAAI,OAAO,EAAE;EAC/D,iBAAiB,EAAE,MAAM,YAAY,qBAAqB,IAAI,OAAO,EAAE;CACzE;AACF"}

package/dist/next/request.d.mts

@@ -0,0 +1,51 @@
+//#region src/next/request.d.ts
+/**
+ * The request guards the portal routes share: same-origin checks, a bounded
+ * body read and the origin a request arrived on.
+ */
+/** The subset of `Headers` these helpers read. Keeps them callable from tests. */
+export type RequestHeaders = {
+  get(name: string): string | null;
+};
+/**
+ * The origin a request arrived on, from its headers, or `fallback`.
+ *
+ * For code that runs inside a Server Action, which has no `Request` to read
+ * `url` from the way a route handler does. `x-forwarded-host` and
+ * `x-forwarded-proto` win over `host` because on Cloudflare and behind Next's
+ * own proxying they name the host the browser typed; a bare `host` is the
+ * last hop. HTTPS is assumed whenever the proto header is missing and the
+ * host is not local — an absolute URL handed to a third party should not
+ * guess `http`.
+ */
+export declare function originFromHeaders(headers: RequestHeaders, fallback: string): string;
+/**
+ * Whether the submission came from a page on somebody else's origin.
+ *
+ * The threat this answers is a page on another origin POSTing here on a
+ * visitor's behalf — for which comparing the declared origin to this site's
+ * own is sufficient, because a browser sets `Origin` on a cross-site POST and
+ * will not let the page lie about it.
+ *
+ * A request that declares NEITHER `Origin` nor `Referer` is let through here;
+ * the routes that mint a session refuse it on their own (`declaresNoOrigin`).
+ *
+ * An origin that will not parse — `null` from a sandboxed frame, or a garbled
+ * one — is treated as somebody else's. It is not this site's.
+ */
+export declare function isCrossOriginRequest(request: Request): boolean;
+/**
+ * The request body as text, or `null` if it is over the ceiling.
+ *
+ * Read in pieces and counted in BYTES, which is the whole point of both
+ * halves. `request.text()` buffers everything before anything can judge it,
+ * and a decoded string's `.length` is UTF-16 code units, not bytes — so
+ * measuring the decoded string against a byte limit lets a multibyte body
+ * several times the ceiling straight through.
+ *
+ * The stream is cancelled the moment the count passes the ceiling, so the
+ * remainder is never pulled across.
+ */
+export declare function readBoundedText(request: Request, maxBytes: number): Promise<string | null>;
+//#endregion
+//# sourceMappingURL=request.d.mts.map