Website: products, library, catalogs and their console page

/products (search), product pages with revisions, getting and staying on a
revision, retracting; /products/:id/edit; /create and new revisions upload
from the browser straight to the catalog with a token from the hub;
/library; /catalogs (directory, registering with a once-shown key);
/console/catalogs to approve or reject. Every page now sends a nonce-based
CSP (proxy.ts), so product descriptions can't run scripts.

buttonVariants now merges classes, so outline links get their border.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/products/actions.ts

@@ -0,0 +1,72 @@
+"use server";
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { api, ApiError, unwrap } from "@/lib/api";
+import { attempt, field, type ActionState } from "@/lib/actions";
+
+const done = (id: string) => {
+  revalidatePath(`/products/${id}`);
+  revalidatePath("/library");
+};
+
+/** The person's library and a product: get it, remove it, stay on a revision or follow the latest. */
+export async function libraryAction(_: ActionState, form: FormData): Promise<ActionState> {
+  const id = field(form, "id");
+  return attempt(async () => {
+    const lib = api.library({ id });
+    switch (field(form, "intent")) {
+      case "get":
+        unwrap(await lib.put());
+        break;
+      case "remove":
+        unwrap(await lib.delete());
+        break;
+      case "stay":
+        unwrap(await lib.patch({ stayOn: Number(field(form, "revision")) }));
+        break;
+      case "follow":
+        unwrap(await lib.patch({ stayOn: null }));
+        break;
+    }
+    done(id);
+  });
+}
+
+export async function retract(_: ActionState, form: FormData): Promise<ActionState> {
+  const id = field(form, "id");
+  return attempt(async () => {
+    unwrap(await api.products({ id }).revisions({ n: Number(field(form, "revision")) }).retract.post());
+    done(id);
+  });
+}
+
+export async function saveProduct(_: ActionState, form: FormData): Promise<ActionState> {
+  const id = field(form, "id");
+  const rating = field(form, "rating");
+  const state = await attempt(async () => {
+    unwrap(
+      await api.products({ id }).patch({
+        name: field(form, "name"),
+        description: typeof form.get("description") === "string" ? String(form.get("description")) : "",
+        ...(rating === "adult" ? { rating: "adult" as const } : {}),
+      }),
+    );
+    done(id);
+    revalidatePath("/products");
+  });
+  if (state?.error) return state;
+  redirect(`/products/${id}`);
+}
+
+/** An upload token and the catalog's upload address, for the browser to send the file there itself. */
+export async function startUpload(
+  catalog: string,
+  product?: string,
+): Promise<{ token: string; url: string } | { error: string }> {
+  try {
+    return unwrap(await api.products.upload.post({ catalog, ...(product ? { product } : {}) }));
+  } catch (e) {
+    if (e instanceof ApiError) return { error: e.message };
+    throw e;
+  }
+}