@onabl/next 0.1.0

package/README.md

@@ -0,0 +1,18 @@
+# `@onabl/next`
+
+Next.js integration for the onabl SDK. Owns the secret-key-holding server
+layer so an integrator's client components never see it — see
+`docs/SDK-DESIGN.md` §1 for the two-file, eleven-line target this package
+exists to make possible.
+
+**Status:** skeleton only (Phase 14 §14.5.4, not started — `@onabl/react`
+has to land first).
+
+## What belongs here
+
+- `createOnablClient(config)` — re-exported from `@onabl/react`/`@onabl/js`
+  with Next-aware cookie handling
+- `onabl.routes()` — the `{GET, POST, PATCH}` route-handler factory, mounted
+  at `app/api/onabl/[...onabl]/route.ts` in a consumer's app
+- The RSC-safe boundary that makes it structurally impossible to pass server
+  config (the secret key) into a client component

package/dist/index.d.mts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { OnablClient } from '@onabl/js';
+
+interface OnablNextConfig {
+    handle: string;
+    secretKey: string;
+    baseUrl?: string;
+    apiVersion?: string;
+    quotePath?: string;
+}
+
+interface OnablRouteHandlers {
+    GET: (req: NextRequest) => Promise<Response>;
+    POST: (req: NextRequest) => Promise<Response>;
+    PATCH: (req: NextRequest) => Promise<Response>;
+}
+/**
+ * Route-handler factory for the same-origin proxy every @onabl/react hook
+ * calls (see packages/react/src/context.tsx) — the reference implementation
+ * of onabl.routes() described in docs/SDK-DESIGN.md §14.5.4. Mount the
+ * returned {GET, POST, PATCH} at a single catch-all route matching
+ * `basePath`, e.g. `app/api/onabl/[...onabl]/route.ts`:
+ *
+ *   export const {GET, POST, PATCH} = createOnablRouteHandlers({
+ *     handle: "acme",
+ *     secretKey: process.env.ONABL_SECRET_KEY!,
+ *     basePath: "/api/onabl",
+ *   });
+ *
+ * Holds config.secretKey server-side only — it never reaches the browser.
+ * Customer access tokens (quote/invoice-scoped, not secrets in the same
+ * sense) are read from/written to an httpOnly cookie per resource UUID (see
+ * cookies.ts) so browser-side hooks never need to carry or send one.
+ */
+declare function createOnablRouteHandlers(config: OnablNextConfig & {
+    basePath?: string;
+}): OnablRouteHandlers;
+
+/**
+ * For Server Component pages (the quote/invoice view pages) to fetch data
+ * with a token read straight off the URL (or props) — not the cookie, since
+ * a Server Component can't set cookies itself. Use together with
+ * `setAccessCookieOn` in a Route Handler the page's first client-side
+ * interaction goes through, or call `setAccessCookieOn` on a redirect
+ * response if the page needs the cookie persisted from a bare `?token=`
+ * link (e.g. an emailed invoice link opened on a device that never went
+ * through the submission flow, so no cookie exists yet).
+ */
+declare function createOnablServerClient(config: OnablNextConfig): OnablClient;
+/** Persists a customer access token as the same httpOnly cookie createOnablRouteHandlers() reads — call this from a Route Handler or Server Action, never from render. */
+declare function setAccessCookieOn(res: NextResponse, uuid: string, token: string): void;
+
+declare function accessCookieName(uuid: string): string;
+/** 30 days — matches the quote/invoice UUID's own practical lifetime; the API is the real source of truth on expiry, this is just how long the browser bothers to keep offering the token. */
+declare const ACCESS_COOKIE_MAX_AGE_SECONDS: number;
+
+export { ACCESS_COOKIE_MAX_AGE_SECONDS, type OnablNextConfig, type OnablRouteHandlers, accessCookieName, createOnablRouteHandlers, createOnablServerClient, setAccessCookieOn };

package/dist/index.d.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { OnablClient } from '@onabl/js';
+
+interface OnablNextConfig {
+    handle: string;
+    secretKey: string;
+    baseUrl?: string;
+    apiVersion?: string;
+    quotePath?: string;
+}
+
+interface OnablRouteHandlers {
+    GET: (req: NextRequest) => Promise<Response>;
+    POST: (req: NextRequest) => Promise<Response>;
+    PATCH: (req: NextRequest) => Promise<Response>;
+}
+/**
+ * Route-handler factory for the same-origin proxy every @onabl/react hook
+ * calls (see packages/react/src/context.tsx) — the reference implementation
+ * of onabl.routes() described in docs/SDK-DESIGN.md §14.5.4. Mount the
+ * returned {GET, POST, PATCH} at a single catch-all route matching
+ * `basePath`, e.g. `app/api/onabl/[...onabl]/route.ts`:
+ *
+ *   export const {GET, POST, PATCH} = createOnablRouteHandlers({
+ *     handle: "acme",
+ *     secretKey: process.env.ONABL_SECRET_KEY!,
+ *     basePath: "/api/onabl",
+ *   });
+ *
+ * Holds config.secretKey server-side only — it never reaches the browser.
+ * Customer access tokens (quote/invoice-scoped, not secrets in the same
+ * sense) are read from/written to an httpOnly cookie per resource UUID (see
+ * cookies.ts) so browser-side hooks never need to carry or send one.
+ */
+declare function createOnablRouteHandlers(config: OnablNextConfig & {
+    basePath?: string;
+}): OnablRouteHandlers;
+
+/**
+ * For Server Component pages (the quote/invoice view pages) to fetch data
+ * with a token read straight off the URL (or props) — not the cookie, since
+ * a Server Component can't set cookies itself. Use together with
+ * `setAccessCookieOn` in a Route Handler the page's first client-side
+ * interaction goes through, or call `setAccessCookieOn` on a redirect
+ * response if the page needs the cookie persisted from a bare `?token=`
+ * link (e.g. an emailed invoice link opened on a device that never went
+ * through the submission flow, so no cookie exists yet).
+ */
+declare function createOnablServerClient(config: OnablNextConfig): OnablClient;
+/** Persists a customer access token as the same httpOnly cookie createOnablRouteHandlers() reads — call this from a Route Handler or Server Action, never from render. */
+declare function setAccessCookieOn(res: NextResponse, uuid: string, token: string): void;
+
+declare function accessCookieName(uuid: string): string;
+/** 30 days — matches the quote/invoice UUID's own practical lifetime; the API is the real source of truth on expiry, this is just how long the browser bothers to keep offering the token. */
+declare const ACCESS_COOKIE_MAX_AGE_SECONDS: number;
+
+export { ACCESS_COOKIE_MAX_AGE_SECONDS, type OnablNextConfig, type OnablRouteHandlers, accessCookieName, createOnablRouteHandlers, createOnablServerClient, setAccessCookieOn };

package/dist/index.js

@@ -0,0 +1,157 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ACCESS_COOKIE_MAX_AGE_SECONDS: () => ACCESS_COOKIE_MAX_AGE_SECONDS,
+  accessCookieName: () => accessCookieName,
+  createOnablRouteHandlers: () => createOnablRouteHandlers,
+  createOnablServerClient: () => createOnablServerClient,
+  setAccessCookieOn: () => setAccessCookieOn
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/route-handlers.ts
+var import_js2 = require("@onabl/js");
+var import_server = require("next/server");
+
+// src/config.ts
+var import_js = require("@onabl/js");
+function buildClient(config) {
+  return (0, import_js.createOnablClient)(config);
+}
+
+// src/cookies.ts
+var COOKIE_PREFIX = "onabl_access_";
+function accessCookieName(uuid) {
+  return `${COOKIE_PREFIX}${uuid}`;
+}
+var ACCESS_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+
+// src/route-handlers.ts
+function errorResponse(err) {
+  if (err instanceof import_js2.OnablError) {
+    return import_server.NextResponse.json({ message: err.message }, { status: err.status ?? 400 });
+  }
+  return import_server.NextResponse.json({ message: "Unexpected error" }, { status: 500 });
+}
+function subpath(req, basePath) {
+  const { pathname } = req.nextUrl;
+  return pathname.startsWith(basePath) ? pathname.slice(basePath.length) : pathname;
+}
+function createOnablRouteHandlers(config) {
+  const basePath = config.basePath ?? "/api/onabl";
+  const client = buildClient(config);
+  async function handleGet(req) {
+    const path = subpath(req, basePath);
+    if (path === "/forms/validate-code") {
+      const code = req.nextUrl.searchParams.get("code") ?? "";
+      const result = await client.forms.validateDiscountCode(code);
+      return import_server.NextResponse.json(result);
+    }
+    return import_server.NextResponse.json({ message: "Not found" }, { status: 404 });
+  }
+  async function handlePost(req) {
+    const path = subpath(req, basePath);
+    if (path === "/submissions") {
+      const body = await req.json();
+      const created = await client.submissions.create(body.answers, {
+        consentGiven: body.consentGiven,
+        discountCode: body.discountCode
+      });
+      const res = import_server.NextResponse.json({ quoteId: created.quoteId, quoteUrl: created.quoteUrl });
+      res.cookies.set(accessCookieName(created.quoteId), created.token, {
+        httpOnly: true,
+        sameSite: "lax",
+        secure: true,
+        maxAge: ACCESS_COOKIE_MAX_AGE_SECONDS,
+        path: "/"
+      });
+      return res;
+    }
+    if (path === "/storage/presign") {
+      const body = await req.json();
+      const token = req.cookies.get(accessCookieName(body.resourceId))?.value;
+      if (!token) return import_server.NextResponse.json({ message: "No access token for this resource" }, { status: 401 });
+      const result = await client.storage.presignPop(body.resourceId, body.filename, body.contentType, body.fileSize, { token });
+      return import_server.NextResponse.json(result);
+    }
+    const acceptMatch = /^\/quotes\/([^/]+)\/accept$/.exec(path);
+    if (acceptMatch) {
+      const uuid = acceptMatch[1];
+      const token = req.cookies.get(accessCookieName(uuid))?.value;
+      if (!token) return import_server.NextResponse.json({ message: "No access token for this quote" }, { status: 401 });
+      await client.quotes.accept(uuid, { token });
+      return import_server.NextResponse.json({ accepted: true });
+    }
+    const declineMatch = /^\/quotes\/([^/]+)\/decline$/.exec(path);
+    if (declineMatch) {
+      const uuid = declineMatch[1];
+      const token = req.cookies.get(accessCookieName(uuid))?.value;
+      if (!token) return import_server.NextResponse.json({ message: "No access token for this quote" }, { status: 401 });
+      const body = await req.json();
+      await client.quotes.decline(uuid, body.declineReason, body.declineNote, { token });
+      return import_server.NextResponse.json({ declined: true });
+    }
+    return import_server.NextResponse.json({ message: "Not found" }, { status: 404 });
+  }
+  async function handlePatch(req) {
+    const path = subpath(req, basePath);
+    const popMatch = /^\/invoices\/([^/]+)\/pop$/.exec(path);
+    if (popMatch) {
+      const uuid = popMatch[1];
+      const token = req.cookies.get(accessCookieName(uuid))?.value;
+      if (!token) return import_server.NextResponse.json({ message: "No access token for this invoice" }, { status: 401 });
+      const body = await req.json();
+      await client.invoices.savePopUrl(uuid, body.key, body.milestone, { token });
+      return import_server.NextResponse.json({ saved: true });
+    }
+    return import_server.NextResponse.json({ message: "Not found" }, { status: 404 });
+  }
+  return {
+    GET: (req) => handleGet(req).catch(errorResponse),
+    POST: (req) => handlePost(req).catch(errorResponse),
+    PATCH: (req) => handlePatch(req).catch(errorResponse)
+  };
+}
+
+// src/server.ts
+var import_js3 = require("@onabl/js");
+function createOnablServerClient(config) {
+  return (0, import_js3.createOnablClient)(config);
+}
+function setAccessCookieOn(res, uuid, token) {
+  res.cookies.set(accessCookieName(uuid), token, {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: true,
+    maxAge: ACCESS_COOKIE_MAX_AGE_SECONDS,
+    path: "/"
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ACCESS_COOKIE_MAX_AGE_SECONDS,
+  accessCookieName,
+  createOnablRouteHandlers,
+  createOnablServerClient,
+  setAccessCookieOn
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/route-handlers.ts","../src/config.ts","../src/cookies.ts","../src/server.ts"],"sourcesContent":["export {createOnablRouteHandlers} from \"./route-handlers\";\nexport type {OnablRouteHandlers} from \"./route-handlers\";\nexport {createOnablServerClient, setAccessCookieOn} from \"./server\";\nexport type {OnablNextConfig} from \"./config\";\nexport {accessCookieName, ACCESS_COOKIE_MAX_AGE_SECONDS} from \"./cookies\";\n","import {OnablError} from \"@onabl/js\";\nimport {NextResponse} from \"next/server\";\nimport type {NextRequest} from \"next/server\";\n\nimport {buildClient, type OnablNextConfig} from \"./config\";\nimport {accessCookieName, ACCESS_COOKIE_MAX_AGE_SECONDS} from \"./cookies\";\n\nexport interface OnablRouteHandlers {\n  GET: (req: NextRequest) => Promise<Response>;\n  POST: (req: NextRequest) => Promise<Response>;\n  PATCH: (req: NextRequest) => Promise<Response>;\n}\n\nfunction errorResponse(err: unknown): NextResponse {\n  if (err instanceof OnablError) {\n    return NextResponse.json({message: err.message}, {status: err.status ?? 400});\n  }\n  return NextResponse.json({message: \"Unexpected error\"}, {status: 500});\n}\n\n/** Strips config.basePath from the incoming request's pathname, e.g. \"/api/onabl/quotes/q-1/accept\" -> \"/quotes/q-1/accept\". */\nfunction subpath(req: NextRequest, basePath: string): string {\n  const {pathname} = req.nextUrl;\n  return pathname.startsWith(basePath) ? pathname.slice(basePath.length) : pathname;\n}\n\n/**\n * Route-handler factory for the same-origin proxy every @onabl/react hook\n * calls (see packages/react/src/context.tsx) — the reference implementation\n * of onabl.routes() described in docs/SDK-DESIGN.md §14.5.4. Mount the\n * returned {GET, POST, PATCH} at a single catch-all route matching\n * `basePath`, e.g. `app/api/onabl/[...onabl]/route.ts`:\n *\n *   export const {GET, POST, PATCH} = createOnablRouteHandlers({\n *     handle: \"acme\",\n *     secretKey: process.env.ONABL_SECRET_KEY!,\n *     basePath: \"/api/onabl\",\n *   });\n *\n * Holds config.secretKey server-side only — it never reaches the browser.\n * Customer access tokens (quote/invoice-scoped, not secrets in the same\n * sense) are read from/written to an httpOnly cookie per resource UUID (see\n * cookies.ts) so browser-side hooks never need to carry or send one.\n */\nexport function createOnablRouteHandlers(config: OnablNextConfig & {basePath?: string}): OnablRouteHandlers {\n  const basePath = config.basePath ?? \"/api/onabl\";\n  const client = buildClient(config);\n\n  async function handleGet(req: NextRequest): Promise<Response> {\n    const path = subpath(req, basePath);\n\n    if (path === \"/forms/validate-code\") {\n      const code = req.nextUrl.searchParams.get(\"code\") ?? \"\";\n      const result = await client.forms.validateDiscountCode(code);\n      return NextResponse.json(result);\n    }\n\n    return NextResponse.json({message: \"Not found\"}, {status: 404});\n  }\n\n  async function handlePost(req: NextRequest): Promise<Response> {\n    const path = subpath(req, basePath);\n\n    if (path === \"/submissions\") {\n      const body = await req.json();\n      const created = await client.submissions.create(body.answers, {\n        consentGiven: body.consentGiven,\n        discountCode: body.discountCode,\n      });\n      const res = NextResponse.json({quoteId: created.quoteId, quoteUrl: created.quoteUrl});\n      res.cookies.set(accessCookieName(created.quoteId), created.token, {\n        httpOnly: true,\n        sameSite: \"lax\",\n        secure: true,\n        maxAge: ACCESS_COOKIE_MAX_AGE_SECONDS,\n        path: \"/\",\n      });\n      return res;\n    }\n\n    if (path === \"/storage/presign\") {\n      const body = await req.json();\n      const token = req.cookies.get(accessCookieName(body.resourceId))?.value;\n      if (!token) return NextResponse.json({message: \"No access token for this resource\"}, {status: 401});\n      const result = await client.storage.presignPop(body.resourceId, body.filename, body.contentType, body.fileSize, {token});\n      return NextResponse.json(result);\n    }\n\n    const acceptMatch = /^\\/quotes\\/([^/]+)\\/accept$/.exec(path);\n    if (acceptMatch) {\n      const uuid = acceptMatch[1]!;\n      const token = req.cookies.get(accessCookieName(uuid))?.value;\n      if (!token) return NextResponse.json({message: \"No access token for this quote\"}, {status: 401});\n      await client.quotes.accept(uuid, {token});\n      return NextResponse.json({accepted: true});\n    }\n\n    const declineMatch = /^\\/quotes\\/([^/]+)\\/decline$/.exec(path);\n    if (declineMatch) {\n      const uuid = declineMatch[1]!;\n      const token = req.cookies.get(accessCookieName(uuid))?.value;\n      if (!token) return NextResponse.json({message: \"No access token for this quote\"}, {status: 401});\n      const body = await req.json();\n      await client.quotes.decline(uuid, body.declineReason, body.declineNote, {token});\n      return NextResponse.json({declined: true});\n    }\n\n    return NextResponse.json({message: \"Not found\"}, {status: 404});\n  }\n\n  async function handlePatch(req: NextRequest): Promise<Response> {\n    const path = subpath(req, basePath);\n\n    const popMatch = /^\\/invoices\\/([^/]+)\\/pop$/.exec(path);\n    if (popMatch) {\n      const uuid = popMatch[1]!;\n      const token = req.cookies.get(accessCookieName(uuid))?.value;\n      if (!token) return NextResponse.json({message: \"No access token for this invoice\"}, {status: 401});\n      const body = await req.json();\n      await client.invoices.savePopUrl(uuid, body.key, body.milestone, {token});\n      return NextResponse.json({saved: true});\n    }\n\n    return NextResponse.json({message: \"Not found\"}, {status: 404});\n  }\n\n  return {\n    GET: (req) => handleGet(req).catch(errorResponse),\n    POST: (req) => handlePost(req).catch(errorResponse),\n    PATCH: (req) => handlePatch(req).catch(errorResponse),\n  };\n}\n","import {createOnablClient, type OnablClient} from \"@onabl/js\";\n\nexport interface OnablNextConfig {\n  handle: string;\n  secretKey: string;\n  baseUrl?: string;\n  apiVersion?: string;\n  quotePath?: string;\n}\n\nexport function buildClient(config: OnablNextConfig): OnablClient {\n  return createOnablClient(config);\n}\n","/**\n * The customer access token for a given quote/invoice UUID is stored in one\n * httpOnly cookie per resource, set by this package's own route handlers\n * (never by client JS — @onabl/react's hooks never see or send it, see\n * packages/react/src/context.tsx). This is what lets useQuoteActions/\n * usePopUpload call this proxy with no auth details of their own: the proxy\n * looks the token up itself from the cookie the browser already carries.\n */\nconst COOKIE_PREFIX = \"onabl_access_\";\n\nexport function accessCookieName(uuid: string): string {\n  return `${COOKIE_PREFIX}${uuid}`;\n}\n\n/** 30 days — matches the quote/invoice UUID's own practical lifetime; the API is the real source of truth on expiry, this is just how long the browser bothers to keep offering the token. */\nexport const ACCESS_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;\n","import {createOnablClient, type OnablClient} from \"@onabl/js\";\nimport type {NextResponse} from \"next/server\";\n\nimport type {OnablNextConfig} from \"./config\";\nimport {accessCookieName, ACCESS_COOKIE_MAX_AGE_SECONDS} from \"./cookies\";\n\n/**\n * For Server Component pages (the quote/invoice view pages) to fetch data\n * with a token read straight off the URL (or props) — not the cookie, since\n * a Server Component can't set cookies itself. Use together with\n * `setAccessCookieOn` in a Route Handler the page's first client-side\n * interaction goes through, or call `setAccessCookieOn` on a redirect\n * response if the page needs the cookie persisted from a bare `?token=`\n * link (e.g. an emailed invoice link opened on a device that never went\n * through the submission flow, so no cookie exists yet).\n */\nexport function createOnablServerClient(config: OnablNextConfig): OnablClient {\n  return createOnablClient(config);\n}\n\n/** Persists a customer access token as the same httpOnly cookie createOnablRouteHandlers() reads — call this from a Route Handler or Server Action, never from render. */\nexport function setAccessCookieOn(res: NextResponse, uuid: string, token: string): void {\n  res.cookies.set(accessCookieName(uuid), token, {\n    httpOnly: true,\n    sameSite: \"lax\",\n    secure: true,\n    maxAge: ACCESS_COOKIE_MAX_AGE_SECONDS,\n    path: \"/\",\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,aAAyB;AACzB,oBAA2B;;;ACD3B,gBAAkD;AAU3C,SAAS,YAAY,QAAsC;AAChE,aAAO,6BAAkB,MAAM;AACjC;;;ACJA,IAAM,gBAAgB;AAEf,SAAS,iBAAiB,MAAsB;AACrD,SAAO,GAAG,aAAa,GAAG,IAAI;AAChC;AAGO,IAAM,gCAAgC,KAAK,KAAK,KAAK;;;AFF5D,SAAS,cAAc,KAA4B;AACjD,MAAI,eAAe,uBAAY;AAC7B,WAAO,2BAAa,KAAK,EAAC,SAAS,IAAI,QAAO,GAAG,EAAC,QAAQ,IAAI,UAAU,IAAG,CAAC;AAAA,EAC9E;AACA,SAAO,2BAAa,KAAK,EAAC,SAAS,mBAAkB,GAAG,EAAC,QAAQ,IAAG,CAAC;AACvE;AAGA,SAAS,QAAQ,KAAkB,UAA0B;AAC3D,QAAM,EAAC,SAAQ,IAAI,IAAI;AACvB,SAAO,SAAS,WAAW,QAAQ,IAAI,SAAS,MAAM,SAAS,MAAM,IAAI;AAC3E;AAoBO,SAAS,yBAAyB,QAAmE;AAC1G,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,SAAS,YAAY,MAAM;AAEjC,iBAAe,UAAU,KAAqC;AAC5D,UAAM,OAAO,QAAQ,KAAK,QAAQ;AAElC,QAAI,SAAS,wBAAwB;AACnC,YAAM,OAAO,IAAI,QAAQ,aAAa,IAAI,MAAM,KAAK;AACrD,YAAM,SAAS,MAAM,OAAO,MAAM,qBAAqB,IAAI;AAC3D,aAAO,2BAAa,KAAK,MAAM;AAAA,IACjC;AAEA,WAAO,2BAAa,KAAK,EAAC,SAAS,YAAW,GAAG,EAAC,QAAQ,IAAG,CAAC;AAAA,EAChE;AAEA,iBAAe,WAAW,KAAqC;AAC7D,UAAM,OAAO,QAAQ,KAAK,QAAQ;AAElC,QAAI,SAAS,gBAAgB;AAC3B,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,UAAU,MAAM,OAAO,YAAY,OAAO,KAAK,SAAS;AAAA,QAC5D,cAAc,KAAK;AAAA,QACnB,cAAc,KAAK;AAAA,MACrB,CAAC;AACD,YAAM,MAAM,2BAAa,KAAK,EAAC,SAAS,QAAQ,SAAS,UAAU,QAAQ,SAAQ,CAAC;AACpF,UAAI,QAAQ,IAAI,iBAAiB,QAAQ,OAAO,GAAG,QAAQ,OAAO;AAAA,QAChE,UAAU;AAAA,QACV,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AAEA,QAAI,SAAS,oBAAoB;AAC/B,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,QAAQ,IAAI,QAAQ,IAAI,iBAAiB,KAAK,UAAU,CAAC,GAAG;AAClE,UAAI,CAAC,MAAO,QAAO,2BAAa,KAAK,EAAC,SAAS,oCAAmC,GAAG,EAAC,QAAQ,IAAG,CAAC;AAClG,YAAM,SAAS,MAAM,OAAO,QAAQ,WAAW,KAAK,YAAY,KAAK,UAAU,KAAK,aAAa,KAAK,UAAU,EAAC,MAAK,CAAC;AACvH,aAAO,2BAAa,KAAK,MAAM;AAAA,IACjC;AAEA,UAAM,cAAc,8BAA8B,KAAK,IAAI;AAC3D,QAAI,aAAa;AACf,YAAM,OAAO,YAAY,CAAC;AAC1B,YAAM,QAAQ,IAAI,QAAQ,IAAI,iBAAiB,IAAI,CAAC,GAAG;AACvD,UAAI,CAAC,MAAO,QAAO,2BAAa,KAAK,EAAC,SAAS,iCAAgC,GAAG,EAAC,QAAQ,IAAG,CAAC;AAC/F,YAAM,OAAO,OAAO,OAAO,MAAM,EAAC,MAAK,CAAC;AACxC,aAAO,2BAAa,KAAK,EAAC,UAAU,KAAI,CAAC;AAAA,IAC3C;AAEA,UAAM,eAAe,+BAA+B,KAAK,IAAI;AAC7D,QAAI,cAAc;AAChB,YAAM,OAAO,aAAa,CAAC;AAC3B,YAAM,QAAQ,IAAI,QAAQ,IAAI,iBAAiB,IAAI,CAAC,GAAG;AACvD,UAAI,CAAC,MAAO,QAAO,2BAAa,KAAK,EAAC,SAAS,iCAAgC,GAAG,EAAC,QAAQ,IAAG,CAAC;AAC/F,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,OAAO,OAAO,QAAQ,MAAM,KAAK,eAAe,KAAK,aAAa,EAAC,MAAK,CAAC;AAC/E,aAAO,2BAAa,KAAK,EAAC,UAAU,KAAI,CAAC;AAAA,IAC3C;AAEA,WAAO,2BAAa,KAAK,EAAC,SAAS,YAAW,GAAG,EAAC,QAAQ,IAAG,CAAC;AAAA,EAChE;AAEA,iBAAe,YAAY,KAAqC;AAC9D,UAAM,OAAO,QAAQ,KAAK,QAAQ;AAElC,UAAM,WAAW,6BAA6B,KAAK,IAAI;AACvD,QAAI,UAAU;AACZ,YAAM,OAAO,SAAS,CAAC;AACvB,YAAM,QAAQ,IAAI,QAAQ,IAAI,iBAAiB,IAAI,CAAC,GAAG;AACvD,UAAI,CAAC,MAAO,QAAO,2BAAa,KAAK,EAAC,SAAS,mCAAkC,GAAG,EAAC,QAAQ,IAAG,CAAC;AACjG,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,OAAO,SAAS,WAAW,MAAM,KAAK,KAAK,KAAK,WAAW,EAAC,MAAK,CAAC;AACxE,aAAO,2BAAa,KAAK,EAAC,OAAO,KAAI,CAAC;AAAA,IACxC;AAEA,WAAO,2BAAa,KAAK,EAAC,SAAS,YAAW,GAAG,EAAC,QAAQ,IAAG,CAAC;AAAA,EAChE;AAEA,SAAO;AAAA,IACL,KAAK,CAAC,QAAQ,UAAU,GAAG,EAAE,MAAM,aAAa;AAAA,IAChD,MAAM,CAAC,QAAQ,WAAW,GAAG,EAAE,MAAM,aAAa;AAAA,IAClD,OAAO,CAAC,QAAQ,YAAY,GAAG,EAAE,MAAM,aAAa;AAAA,EACtD;AACF;;;AGnIA,IAAAC,aAAkD;AAgB3C,SAAS,wBAAwB,QAAsC;AAC5E,aAAO,8BAAkB,MAAM;AACjC;AAGO,SAAS,kBAAkB,KAAmB,MAAc,OAAqB;AACtF,MAAI,QAAQ,IAAI,iBAAiB,IAAI,GAAG,OAAO;AAAA,IAC7C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;","names":["import_js","import_js"]}

package/dist/index.mjs

@@ -0,0 +1,126 @@
+// src/route-handlers.ts
+import { OnablError } from "@onabl/js";
+import { NextResponse } from "next/server";
+
+// src/config.ts
+import { createOnablClient } from "@onabl/js";
+function buildClient(config) {
+  return createOnablClient(config);
+}
+
+// src/cookies.ts
+var COOKIE_PREFIX = "onabl_access_";
+function accessCookieName(uuid) {
+  return `${COOKIE_PREFIX}${uuid}`;
+}
+var ACCESS_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+
+// src/route-handlers.ts
+function errorResponse(err) {
+  if (err instanceof OnablError) {
+    return NextResponse.json({ message: err.message }, { status: err.status ?? 400 });
+  }
+  return NextResponse.json({ message: "Unexpected error" }, { status: 500 });
+}
+function subpath(req, basePath) {
+  const { pathname } = req.nextUrl;
+  return pathname.startsWith(basePath) ? pathname.slice(basePath.length) : pathname;
+}
+function createOnablRouteHandlers(config) {
+  const basePath = config.basePath ?? "/api/onabl";
+  const client = buildClient(config);
+  async function handleGet(req) {
+    const path = subpath(req, basePath);
+    if (path === "/forms/validate-code") {
+      const code = req.nextUrl.searchParams.get("code") ?? "";
+      const result = await client.forms.validateDiscountCode(code);
+      return NextResponse.json(result);
+    }
+    return NextResponse.json({ message: "Not found" }, { status: 404 });
+  }
+  async function handlePost(req) {
+    const path = subpath(req, basePath);
+    if (path === "/submissions") {
+      const body = await req.json();
+      const created = await client.submissions.create(body.answers, {
+        consentGiven: body.consentGiven,
+        discountCode: body.discountCode
+      });
+      const res = NextResponse.json({ quoteId: created.quoteId, quoteUrl: created.quoteUrl });
+      res.cookies.set(accessCookieName(created.quoteId), created.token, {
+        httpOnly: true,
+        sameSite: "lax",
+        secure: true,
+        maxAge: ACCESS_COOKIE_MAX_AGE_SECONDS,
+        path: "/"
+      });
+      return res;
+    }
+    if (path === "/storage/presign") {
+      const body = await req.json();
+      const token = req.cookies.get(accessCookieName(body.resourceId))?.value;
+      if (!token) return NextResponse.json({ message: "No access token for this resource" }, { status: 401 });
+      const result = await client.storage.presignPop(body.resourceId, body.filename, body.contentType, body.fileSize, { token });
+      return NextResponse.json(result);
+    }
+    const acceptMatch = /^\/quotes\/([^/]+)\/accept$/.exec(path);
+    if (acceptMatch) {
+      const uuid = acceptMatch[1];
+      const token = req.cookies.get(accessCookieName(uuid))?.value;
+      if (!token) return NextResponse.json({ message: "No access token for this quote" }, { status: 401 });
+      await client.quotes.accept(uuid, { token });
+      return NextResponse.json({ accepted: true });
+    }
+    const declineMatch = /^\/quotes\/([^/]+)\/decline$/.exec(path);
+    if (declineMatch) {
+      const uuid = declineMatch[1];
+      const token = req.cookies.get(accessCookieName(uuid))?.value;
+      if (!token) return NextResponse.json({ message: "No access token for this quote" }, { status: 401 });
+      const body = await req.json();
+      await client.quotes.decline(uuid, body.declineReason, body.declineNote, { token });
+      return NextResponse.json({ declined: true });
+    }
+    return NextResponse.json({ message: "Not found" }, { status: 404 });
+  }
+  async function handlePatch(req) {
+    const path = subpath(req, basePath);
+    const popMatch = /^\/invoices\/([^/]+)\/pop$/.exec(path);
+    if (popMatch) {
+      const uuid = popMatch[1];
+      const token = req.cookies.get(accessCookieName(uuid))?.value;
+      if (!token) return NextResponse.json({ message: "No access token for this invoice" }, { status: 401 });
+      const body = await req.json();
+      await client.invoices.savePopUrl(uuid, body.key, body.milestone, { token });
+      return NextResponse.json({ saved: true });
+    }
+    return NextResponse.json({ message: "Not found" }, { status: 404 });
+  }
+  return {
+    GET: (req) => handleGet(req).catch(errorResponse),
+    POST: (req) => handlePost(req).catch(errorResponse),
+    PATCH: (req) => handlePatch(req).catch(errorResponse)
+  };
+}
+
+// src/server.ts
+import { createOnablClient as createOnablClient2 } from "@onabl/js";
+function createOnablServerClient(config) {
+  return createOnablClient2(config);
+}
+function setAccessCookieOn(res, uuid, token) {
+  res.cookies.set(accessCookieName(uuid), token, {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: true,
+    maxAge: ACCESS_COOKIE_MAX_AGE_SECONDS,
+    path: "/"
+  });
+}
+export {
+  ACCESS_COOKIE_MAX_AGE_SECONDS,
+  accessCookieName,
+  createOnablRouteHandlers,
+  createOnablServerClient,
+  setAccessCookieOn
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/route-handlers.ts","../src/config.ts","../src/cookies.ts","../src/server.ts"],"sourcesContent":["import {OnablError} from \"@onabl/js\";\nimport {NextResponse} from \"next/server\";\nimport type {NextRequest} from \"next/server\";\n\nimport {buildClient, type OnablNextConfig} from \"./config\";\nimport {accessCookieName, ACCESS_COOKIE_MAX_AGE_SECONDS} from \"./cookies\";\n\nexport interface OnablRouteHandlers {\n  GET: (req: NextRequest) => Promise<Response>;\n  POST: (req: NextRequest) => Promise<Response>;\n  PATCH: (req: NextRequest) => Promise<Response>;\n}\n\nfunction errorResponse(err: unknown): NextResponse {\n  if (err instanceof OnablError) {\n    return NextResponse.json({message: err.message}, {status: err.status ?? 400});\n  }\n  return NextResponse.json({message: \"Unexpected error\"}, {status: 500});\n}\n\n/** Strips config.basePath from the incoming request's pathname, e.g. \"/api/onabl/quotes/q-1/accept\" -> \"/quotes/q-1/accept\". */\nfunction subpath(req: NextRequest, basePath: string): string {\n  const {pathname} = req.nextUrl;\n  return pathname.startsWith(basePath) ? pathname.slice(basePath.length) : pathname;\n}\n\n/**\n * Route-handler factory for the same-origin proxy every @onabl/react hook\n * calls (see packages/react/src/context.tsx) — the reference implementation\n * of onabl.routes() described in docs/SDK-DESIGN.md §14.5.4. Mount the\n * returned {GET, POST, PATCH} at a single catch-all route matching\n * `basePath`, e.g. `app/api/onabl/[...onabl]/route.ts`:\n *\n *   export const {GET, POST, PATCH} = createOnablRouteHandlers({\n *     handle: \"acme\",\n *     secretKey: process.env.ONABL_SECRET_KEY!,\n *     basePath: \"/api/onabl\",\n *   });\n *\n * Holds config.secretKey server-side only — it never reaches the browser.\n * Customer access tokens (quote/invoice-scoped, not secrets in the same\n * sense) are read from/written to an httpOnly cookie per resource UUID (see\n * cookies.ts) so browser-side hooks never need to carry or send one.\n */\nexport function createOnablRouteHandlers(config: OnablNextConfig & {basePath?: string}): OnablRouteHandlers {\n  const basePath = config.basePath ?? \"/api/onabl\";\n  const client = buildClient(config);\n\n  async function handleGet(req: NextRequest): Promise<Response> {\n    const path = subpath(req, basePath);\n\n    if (path === \"/forms/validate-code\") {\n      const code = req.nextUrl.searchParams.get(\"code\") ?? \"\";\n      const result = await client.forms.validateDiscountCode(code);\n      return NextResponse.json(result);\n    }\n\n    return NextResponse.json({message: \"Not found\"}, {status: 404});\n  }\n\n  async function handlePost(req: NextRequest): Promise<Response> {\n    const path = subpath(req, basePath);\n\n    if (path === \"/submissions\") {\n      const body = await req.json();\n      const created = await client.submissions.create(body.answers, {\n        consentGiven: body.consentGiven,\n        discountCode: body.discountCode,\n      });\n      const res = NextResponse.json({quoteId: created.quoteId, quoteUrl: created.quoteUrl});\n      res.cookies.set(accessCookieName(created.quoteId), created.token, {\n        httpOnly: true,\n        sameSite: \"lax\",\n        secure: true,\n        maxAge: ACCESS_COOKIE_MAX_AGE_SECONDS,\n        path: \"/\",\n      });\n      return res;\n    }\n\n    if (path === \"/storage/presign\") {\n      const body = await req.json();\n      const token = req.cookies.get(accessCookieName(body.resourceId))?.value;\n      if (!token) return NextResponse.json({message: \"No access token for this resource\"}, {status: 401});\n      const result = await client.storage.presignPop(body.resourceId, body.filename, body.contentType, body.fileSize, {token});\n      return NextResponse.json(result);\n    }\n\n    const acceptMatch = /^\\/quotes\\/([^/]+)\\/accept$/.exec(path);\n    if (acceptMatch) {\n      const uuid = acceptMatch[1]!;\n      const token = req.cookies.get(accessCookieName(uuid))?.value;\n      if (!token) return NextResponse.json({message: \"No access token for this quote\"}, {status: 401});\n      await client.quotes.accept(uuid, {token});\n      return NextResponse.json({accepted: true});\n    }\n\n    const declineMatch = /^\\/quotes\\/([^/]+)\\/decline$/.exec(path);\n    if (declineMatch) {\n      const uuid = declineMatch[1]!;\n      const token = req.cookies.get(accessCookieName(uuid))?.value;\n      if (!token) return NextResponse.json({message: \"No access token for this quote\"}, {status: 401});\n      const body = await req.json();\n      await client.quotes.decline(uuid, body.declineReason, body.declineNote, {token});\n      return NextResponse.json({declined: true});\n    }\n\n    return NextResponse.json({message: \"Not found\"}, {status: 404});\n  }\n\n  async function handlePatch(req: NextRequest): Promise<Response> {\n    const path = subpath(req, basePath);\n\n    const popMatch = /^\\/invoices\\/([^/]+)\\/pop$/.exec(path);\n    if (popMatch) {\n      const uuid = popMatch[1]!;\n      const token = req.cookies.get(accessCookieName(uuid))?.value;\n      if (!token) return NextResponse.json({message: \"No access token for this invoice\"}, {status: 401});\n      const body = await req.json();\n      await client.invoices.savePopUrl(uuid, body.key, body.milestone, {token});\n      return NextResponse.json({saved: true});\n    }\n\n    return NextResponse.json({message: \"Not found\"}, {status: 404});\n  }\n\n  return {\n    GET: (req) => handleGet(req).catch(errorResponse),\n    POST: (req) => handlePost(req).catch(errorResponse),\n    PATCH: (req) => handlePatch(req).catch(errorResponse),\n  };\n}\n","import {createOnablClient, type OnablClient} from \"@onabl/js\";\n\nexport interface OnablNextConfig {\n  handle: string;\n  secretKey: string;\n  baseUrl?: string;\n  apiVersion?: string;\n  quotePath?: string;\n}\n\nexport function buildClient(config: OnablNextConfig): OnablClient {\n  return createOnablClient(config);\n}\n","/**\n * The customer access token for a given quote/invoice UUID is stored in one\n * httpOnly cookie per resource, set by this package's own route handlers\n * (never by client JS — @onabl/react's hooks never see or send it, see\n * packages/react/src/context.tsx). This is what lets useQuoteActions/\n * usePopUpload call this proxy with no auth details of their own: the proxy\n * looks the token up itself from the cookie the browser already carries.\n */\nconst COOKIE_PREFIX = \"onabl_access_\";\n\nexport function accessCookieName(uuid: string): string {\n  return `${COOKIE_PREFIX}${uuid}`;\n}\n\n/** 30 days — matches the quote/invoice UUID's own practical lifetime; the API is the real source of truth on expiry, this is just how long the browser bothers to keep offering the token. */\nexport const ACCESS_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;\n","import {createOnablClient, type OnablClient} from \"@onabl/js\";\nimport type {NextResponse} from \"next/server\";\n\nimport type {OnablNextConfig} from \"./config\";\nimport {accessCookieName, ACCESS_COOKIE_MAX_AGE_SECONDS} from \"./cookies\";\n\n/**\n * For Server Component pages (the quote/invoice view pages) to fetch data\n * with a token read straight off the URL (or props) — not the cookie, since\n * a Server Component can't set cookies itself. Use together with\n * `setAccessCookieOn` in a Route Handler the page's first client-side\n * interaction goes through, or call `setAccessCookieOn` on a redirect\n * response if the page needs the cookie persisted from a bare `?token=`\n * link (e.g. an emailed invoice link opened on a device that never went\n * through the submission flow, so no cookie exists yet).\n */\nexport function createOnablServerClient(config: OnablNextConfig): OnablClient {\n  return createOnablClient(config);\n}\n\n/** Persists a customer access token as the same httpOnly cookie createOnablRouteHandlers() reads — call this from a Route Handler or Server Action, never from render. */\nexport function setAccessCookieOn(res: NextResponse, uuid: string, token: string): void {\n  res.cookies.set(accessCookieName(uuid), token, {\n    httpOnly: true,\n    sameSite: \"lax\",\n    secure: true,\n    maxAge: ACCESS_COOKIE_MAX_AGE_SECONDS,\n    path: \"/\",\n  });\n}\n"],"mappings":";AAAA,SAAQ,kBAAiB;AACzB,SAAQ,oBAAmB;;;ACD3B,SAAQ,yBAA0C;AAU3C,SAAS,YAAY,QAAsC;AAChE,SAAO,kBAAkB,MAAM;AACjC;;;ACJA,IAAM,gBAAgB;AAEf,SAAS,iBAAiB,MAAsB;AACrD,SAAO,GAAG,aAAa,GAAG,IAAI;AAChC;AAGO,IAAM,gCAAgC,KAAK,KAAK,KAAK;;;AFF5D,SAAS,cAAc,KAA4B;AACjD,MAAI,eAAe,YAAY;AAC7B,WAAO,aAAa,KAAK,EAAC,SAAS,IAAI,QAAO,GAAG,EAAC,QAAQ,IAAI,UAAU,IAAG,CAAC;AAAA,EAC9E;AACA,SAAO,aAAa,KAAK,EAAC,SAAS,mBAAkB,GAAG,EAAC,QAAQ,IAAG,CAAC;AACvE;AAGA,SAAS,QAAQ,KAAkB,UAA0B;AAC3D,QAAM,EAAC,SAAQ,IAAI,IAAI;AACvB,SAAO,SAAS,WAAW,QAAQ,IAAI,SAAS,MAAM,SAAS,MAAM,IAAI;AAC3E;AAoBO,SAAS,yBAAyB,QAAmE;AAC1G,QAAM,WAAW,OAAO,YAAY;AACpC,QAAM,SAAS,YAAY,MAAM;AAEjC,iBAAe,UAAU,KAAqC;AAC5D,UAAM,OAAO,QAAQ,KAAK,QAAQ;AAElC,QAAI,SAAS,wBAAwB;AACnC,YAAM,OAAO,IAAI,QAAQ,aAAa,IAAI,MAAM,KAAK;AACrD,YAAM,SAAS,MAAM,OAAO,MAAM,qBAAqB,IAAI;AAC3D,aAAO,aAAa,KAAK,MAAM;AAAA,IACjC;AAEA,WAAO,aAAa,KAAK,EAAC,SAAS,YAAW,GAAG,EAAC,QAAQ,IAAG,CAAC;AAAA,EAChE;AAEA,iBAAe,WAAW,KAAqC;AAC7D,UAAM,OAAO,QAAQ,KAAK,QAAQ;AAElC,QAAI,SAAS,gBAAgB;AAC3B,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,UAAU,MAAM,OAAO,YAAY,OAAO,KAAK,SAAS;AAAA,QAC5D,cAAc,KAAK;AAAA,QACnB,cAAc,KAAK;AAAA,MACrB,CAAC;AACD,YAAM,MAAM,aAAa,KAAK,EAAC,SAAS,QAAQ,SAAS,UAAU,QAAQ,SAAQ,CAAC;AACpF,UAAI,QAAQ,IAAI,iBAAiB,QAAQ,OAAO,GAAG,QAAQ,OAAO;AAAA,QAChE,UAAU;AAAA,QACV,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AAEA,QAAI,SAAS,oBAAoB;AAC/B,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,QAAQ,IAAI,QAAQ,IAAI,iBAAiB,KAAK,UAAU,CAAC,GAAG;AAClE,UAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAC,SAAS,oCAAmC,GAAG,EAAC,QAAQ,IAAG,CAAC;AAClG,YAAM,SAAS,MAAM,OAAO,QAAQ,WAAW,KAAK,YAAY,KAAK,UAAU,KAAK,aAAa,KAAK,UAAU,EAAC,MAAK,CAAC;AACvH,aAAO,aAAa,KAAK,MAAM;AAAA,IACjC;AAEA,UAAM,cAAc,8BAA8B,KAAK,IAAI;AAC3D,QAAI,aAAa;AACf,YAAM,OAAO,YAAY,CAAC;AAC1B,YAAM,QAAQ,IAAI,QAAQ,IAAI,iBAAiB,IAAI,CAAC,GAAG;AACvD,UAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAC,SAAS,iCAAgC,GAAG,EAAC,QAAQ,IAAG,CAAC;AAC/F,YAAM,OAAO,OAAO,OAAO,MAAM,EAAC,MAAK,CAAC;AACxC,aAAO,aAAa,KAAK,EAAC,UAAU,KAAI,CAAC;AAAA,IAC3C;AAEA,UAAM,eAAe,+BAA+B,KAAK,IAAI;AAC7D,QAAI,cAAc;AAChB,YAAM,OAAO,aAAa,CAAC;AAC3B,YAAM,QAAQ,IAAI,QAAQ,IAAI,iBAAiB,IAAI,CAAC,GAAG;AACvD,UAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAC,SAAS,iCAAgC,GAAG,EAAC,QAAQ,IAAG,CAAC;AAC/F,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,OAAO,OAAO,QAAQ,MAAM,KAAK,eAAe,KAAK,aAAa,EAAC,MAAK,CAAC;AAC/E,aAAO,aAAa,KAAK,EAAC,UAAU,KAAI,CAAC;AAAA,IAC3C;AAEA,WAAO,aAAa,KAAK,EAAC,SAAS,YAAW,GAAG,EAAC,QAAQ,IAAG,CAAC;AAAA,EAChE;AAEA,iBAAe,YAAY,KAAqC;AAC9D,UAAM,OAAO,QAAQ,KAAK,QAAQ;AAElC,UAAM,WAAW,6BAA6B,KAAK,IAAI;AACvD,QAAI,UAAU;AACZ,YAAM,OAAO,SAAS,CAAC;AACvB,YAAM,QAAQ,IAAI,QAAQ,IAAI,iBAAiB,IAAI,CAAC,GAAG;AACvD,UAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAC,SAAS,mCAAkC,GAAG,EAAC,QAAQ,IAAG,CAAC;AACjG,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,OAAO,SAAS,WAAW,MAAM,KAAK,KAAK,KAAK,WAAW,EAAC,MAAK,CAAC;AACxE,aAAO,aAAa,KAAK,EAAC,OAAO,KAAI,CAAC;AAAA,IACxC;AAEA,WAAO,aAAa,KAAK,EAAC,SAAS,YAAW,GAAG,EAAC,QAAQ,IAAG,CAAC;AAAA,EAChE;AAEA,SAAO;AAAA,IACL,KAAK,CAAC,QAAQ,UAAU,GAAG,EAAE,MAAM,aAAa;AAAA,IAChD,MAAM,CAAC,QAAQ,WAAW,GAAG,EAAE,MAAM,aAAa;AAAA,IAClD,OAAO,CAAC,QAAQ,YAAY,GAAG,EAAE,MAAM,aAAa;AAAA,EACtD;AACF;;;AGnIA,SAAQ,qBAAAA,0BAA0C;AAgB3C,SAAS,wBAAwB,QAAsC;AAC5E,SAAOC,mBAAkB,MAAM;AACjC;AAGO,SAAS,kBAAkB,KAAmB,MAAc,OAAqB;AACtF,MAAI,QAAQ,IAAI,iBAAiB,IAAI,GAAG,OAAO;AAAA,IAC7C,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;","names":["createOnablClient","createOnablClient"]}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@onabl/next",
+  "version": "0.1.0",
+  "description": "Next.js integration for the onabl SDK — server-action-free route-handler factory, cookie-aware client, RSC-safe boundary. See docs/SDK-DESIGN.md.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/visualcreme-studios/onabl.git",
+    "directory": "packages/next"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    }
+  },
+  "devDependencies": {
+    "@types/react": "^19",
+    "eslint": "latest",
+    "next": "latest",
+    "tsup": "^8.0.0",
+    "vitest": "^1.6.0",
+    "typescript": "^5.4.0",
+    "@onabl/typescript-config": "0.0.1",
+    "@onabl/eslint-config": "0.0.1"
+  },
+  "dependencies": {
+    "@onabl/js": "0.1.0",
+    "@onabl/react": "0.1.0"
+  },
+  "peerDependencies": {
+    "next": "^16",
+    "react": "^19"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}