# vordur.is — Vörður tryggingar (Mínar síður)

Insurance harvester: policies, claims history, payments, the no-claims
counter and the travel certificate from the [Mínar síður](https://vordur.is/innskraning) portal.

## Auth — email + password, in a headed window

Vörður uses a plain **netfang + lykilorð** login (no eID needed). The portal
is a Next.js SPA with **no public API** — the harvester runs inside the
logged-in agent-browser session:

```bash
ab-plus login vordur.is          # opens the headed window — you log in
ab-plus run vordur.is/overview   # overview + no-claims counter + refunds
ab-plus run vordur.is/policies   # policy rows from the rendered tables
ab-plus run vordur.is/documents  # Rafræn skjöl (skírteini / summaries)
```

## Data vs PDF — what the sweep found

Static analysis of the portal's own JS bundles (routes + page components):

- **The portal renders insurance data in-page**: `/minar-sidur/yfirlitssida`
  (overview dashboard), `/minar-sidur/tryggingar` (Mínar tryggingar /
  Heimilið / Endurnýjun / í vinnslu tabs), `/minar-sidur/tjon` (Tjónasaga),
  `/minar-sidur/greidslur`, and `/minar-sidur/ferdastadfesting` (travel
  certificate — the component code references SSN, policy types like
  SUMARBUSTA, and insurance brands PNC/VIS/NOVIS, i.e. real rendered data).
- **There is also an owner-only documents section** (`/minar-sidur/rafraen-skjol`,
  `hideForViewAccess: true`) — most likely where skírteini/tryggingayfirlit
  **PDF downloads** live (the INSURANCE.md source was such a PDF).
- **Sealed by the first logged-in run (2026-08-21):** policy data is
  **rendered in-page** (the `Trygging | Hið tryggða | Fastanr. | Gildistími |
  Tryggingafjárhæð | Iðgjald | Skírteini` table on yfirlitssida). Skírteini
  are **PDF downloads per policy** via `https://vordur.is/api/certificate-pdf-view?PolicyNo=<no>`,
  and Rafræn skjöl documents are PDFs via `https://vordur.is/api/document/pdf-view?id=<id>`
  (both authenticated, in-session). The harvester returns the rendered data
  AND the download links.

## Ops

| Op | Risk | Notes |
|---|---|---|
| `overview` | read-only | Dashboard + signals (Tjónlaus í X mánuði, refunds, premiums) |
| `policies` | read-only | Rendered policy rows (skírteini, iðgjöld, validity) |
| `documents` | read-only | Rafræn skjöl — rendered rows or PDF links (confirmed on first run) |
| `probe` | read-only | Page structure dump for recipe maintenance |

## Gotchas

- Session TTL is short (~1h of inactivity is generous; re-login when ops
  land on `innskraning`).
- Never automate the email/password form itself — the human logs in in the
  headed window (no AI in the auth loop, and it keeps the account safe).
- The data model in `~/Code/home/INSURANCE.md` (skírteini, iðgjöld,
  endurnýjunardagatal, endurgreiðslur) is the target shape for a future
  structured `policies` output.