@guard-rail/core 0.1.0

package/README.md

@@ -0,0 +1,339 @@
+# Guardrail
+
+Lightweight inline content editing for developer-owned Next.js sites.
+
+Guardrail lets a marketer edit the copy and images on a site you built, without
+taking control of your markup, styling, routes, or build. There is no content
+model to define and no dashboard to configure — you wrap the strings you want
+editable, and that's the whole surface area.
+
+## How it works
+
+- **Anonymous visitors get server-rendered HTML.** `<GRail>` is an async Server
+  Component; it resolves content during SSR and ships no editor JavaScript.
+- **The editor only loads for a verified session.** Client components are
+  reached only after the auth adapter confirms a real session.
+- **Un-edited fields render the JSX you wrote.** Nothing is written to the
+  database until an editor saves, so a fresh install renders your hardcoded
+  content unchanged.
+
+## Install
+
+```bash
+pnpm add @guard-rail/core @supabase/ssr @supabase/supabase-js
+```
+
+Set up the database:
+
+1. Copy `node_modules/guardrail/supabase/migrations/*.sql` into your own
+   project's `supabase/migrations/`, then run `supabase db push`. No Supabase
+   CLI yet? Paste the file's contents into the SQL editor instead — it runs
+   the same statements, just without the CLI's version tracking.
+2. **Required:** add `guardrail` under **Settings > API > Exposed schemas** in
+   the Supabase dashboard. PostgREST only serves schemas on that list; every
+   table below is otherwise invisible to the client with a "not found in
+   schema cache" error that looks identical to a missing table.
+
+Guardrail's tables live in their own `guardrail` Postgres schema, not `public`
+— so a `supabase db reset`, a broad `DROP ... CASCADE`, or a migration tool
+that treats `public` as its own to reconcile can't touch them.
+
+```bash
+SUPABASE_URL=...
+SUPABASE_ANON_KEY=...
+GUARDRAIL_SITE_ID=my-site   # optional; defaults to "default"
+```
+
+## Usage
+
+Wrap the root layout:
+
+```tsx
+// app/layout.tsx
+import { withGuardrail } from "@guard-rail/core";
+
+export default withGuardrail(function RootLayout({ children }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+});
+```
+
+Mark fields editable:
+
+```tsx
+import { GRail } from "@guard-rail/core";
+
+<GRail id="home.hero.title" as="h1" className="text-3xl font-bold">
+  Ship faster with less friction
+</GRail>
+
+<GRail id="home.hero.logo" type="image" as="img" src="/logo.svg" alt="Logo" />
+```
+
+`id` is the content key. `className` and every other prop pass straight through
+to the element — Guardrail never styles your content.
+
+To edit, visit any page with `?edit=true`, sign in with a Supabase user, and
+click a field.
+
+## Team and roles
+
+Two roles, deliberately not a permission matrix:
+
+| Role | Can |
+|---|---|
+| `admin` | edit content, manage the team |
+| `editor` | edit content |
+
+There is no read-only "viewer" — without edit access, a member sees exactly
+what an anonymous visitor sees, which is already the site's own frontend.
+
+Membership is Guardrail's own table, not the auth provider's, so the identity
+vendor and the database vendor never have to be the same. Invites are recorded
+against an email address and claimed when that person first signs in.
+
+Guardrail records an invite but does not send it — wire your own mail provider:
+
+```tsx
+export default withGuardrail(RootLayout, {
+  onInvite: async ({ email, role, siteId, invitedBy }) => {
+    await resend.emails.send({ to: email, /* your template */ });
+  },
+});
+```
+
+**Invite emails (Supabase).** Inviting someone creates their account on first
+use and emails them a sign-in link. Three one-time steps in the Supabase
+dashboard, plus one route in your app:
+
+1. **Route** — `app/guardrail/confirm/route.ts`:
+   ```ts
+   export const GET = supabaseConfirmRoute({ url, anonKey });
+   ```
+2. **Auth → URL Configuration** — set Site URL to your app's origin, and add
+   `<origin>/**` to Redirect URLs.
+3. **Auth → Email Templates** — in both **Confirm signup** and **Magic Link**,
+   point the link at the confirm route using the token hash:
+   ```html
+   <a href="{{ .SiteURL }}/guardrail/confirm?token_hash={{ .TokenHash }}&type=email">Sign in</a>
+   ```
+   The default `{{ .ConfirmationURL }}` uses a PKCE code that only works in
+   the browser that requested it — the admin's, not the invitee's.
+4. **Auth → SMTP** — Supabase's built-in mailer allows only a few emails an
+   hour. Configure custom SMTP (Resend, Postmark, SES) before relying on
+   invites. Submitting the same address again re-sends a pending invite.
+
+**Bootstrapping.** A site with no members has nobody who can add members, and
+there is deliberately no in-app way to grant yourself a role — that would mean
+an RLS policy letting a user write their own membership row, which is the same
+as letting anyone make themselves an admin. Seed the first admin with the SQL
+at the bottom of the init migration.
+
+The bundled drawer lives behind the toolbar's **Team** button. To build your
+own instead, `listTeam`, `inviteMember`, `updateMemberRole`, and `removeMember`
+are exported from the package root.
+
+## Images and storage
+
+Storage is its own adapter slot, separate from the database, so media can live
+with a different provider than content. It is optional — without it, image
+fields fall back to a plain URL input.
+
+```tsx
+storage: supabaseStorage({
+  url, anonKey,
+  bucket: process.env.GUARDRAIL_STORAGE_BUCKET, // optional, defaults to "gr-media"
+}),
+```
+
+Editors get a picker to browse, upload, and select images. Files go straight
+from the browser to storage via a signed URL — server actions cap bodies at
+~1MB, so bytes never pass through Next.js. PNG, JPEG, WebP, GIF, and AVIF up to
+10 MB; SVG is excluded because it can carry script.
+
+Images are scaled down in the browser before upload so their longest edge is at
+most 2560px — WordPress's default — and re-encoding strips EXIF data such as GPS
+location. Anything already within that size uploads untouched. GIF (animation)
+and AVIF (limited browser encoding) are never resized. Because this runs
+client-side it is a convenience, not enforcement; the 10 MB cap still applies to
+the file after resizing.
+
+**Setup**
+
+1. The init migration creates the default `gr-media` bucket and storage
+   policies scoped to the `gr-` prefix. To use a different bucket, just pass
+   its name: any `gr-*` bucket is created automatically on the first upload,
+   no SQL edits needed.
+2. Allow the storage host in `next.config.ts`, or `next/image` will throw:
+   ```ts
+   images: {
+     remotePatterns: [{
+       protocol: "https",
+       hostname: new URL(process.env.SUPABASE_URL!).hostname,
+       pathname: "/storage/v1/object/public/**",
+     }],
+   },
+   ```
+
+Alt text is stored on the field, not the file — one image can need different
+alt text on different pages. Natural size is measured when an image is picked;
+the developer's `width` stays fixed and height follows the new image's
+proportions, so a replacement never stretches or breaks the layout.
+
+## Repeaters
+
+Field editing answers "change what's here." It has no answer for "add a
+thing" — a new service card, blog post, or product — because there is no JSX
+for a marketer to click on. `<GRepeater>` is the one primitive for that: an
+ordered list of instances of **one developer-authored template component**.
+Not a schema, not a content model — the shape of an item is whatever JSX the
+template renders, using ordinary `<GRail>` fields namespaced under the item's
+id. Adding a field to an item means adding another `<GRail>`, same as
+anywhere else.
+
+```tsx
+// components/ServiceCard.tsx — the one place the item's shape lives
+function ServiceCard({ item }: RepeaterItemProps) {
+  return (
+    <div>
+      <GRail id={`services.${item.id}.title`} as="h3">New service</GRail>
+      <GRail id={`services.${item.id}.description`}>Describe it.</GRail>
+    </div>
+  );
+}
+
+// A row of cards, all on one page:
+<GRepeater id="services" as={ServiceCard} />
+```
+
+Editors get add/remove/reorder controls; anonymous visitors get the template
+rendered N times with no admin JS, same SSR/CSR split as `<GRail>` itself.
+
+**Routed items** — a product, a blog post — additionally get their own page.
+Guardrail never owns routing: pass `routed`, which prompts for a slug when an
+item is added, and the developer writes an ordinary dynamic route that
+resolves the item by that slug:
+
+```tsx
+// app/products/[slug]/page.tsx
+export async function generateStaticParams() {
+  const items = await listRepeaterItems("products");
+  return items.filter((i) => i.slug).map((i) => ({ slug: i.slug! }));
+}
+
+export default async function ProductPage({ params }) {
+  const { slug } = await params;
+  const item = await getRepeaterItemBySlug("products", slug);
+  if (!item) notFound();
+  return <GRail id={`products.${item.id}.name`} as="h1">New product</GRail>;
+}
+```
+
+The developer still owns the template, the route pattern, and whether the page
+is static or dynamic. A repeater only ever answers "how many, and in what
+order" — never "what shape."
+
+On a routed item's own summary card, give its fields `editable={false}` so the
+card stays purely a link to the item's page rather than competing with it for
+clicks — editing then only happens on the canonical route, where the same
+fields render fully editable with no `editable` prop needed:
+
+```tsx
+// The card that links elsewhere: display only.
+<GRail id={`products.${item.id}.name`} editable={false}>New product</GRail>
+
+// The item's own page: same field, fully editable.
+<GRail id={`products.${item.id}.name`}>New product</GRail>
+```
+
+`editable={false}` works on any `<GRail>`, not only inside a repeater — useful
+anywhere content is shown without wanting an edit affordance there.
+
+**Not covered, on purpose:** relations between items, custom field types,
+filtering/querying, commerce logic, or a marketer freely composing a page from
+scratch. A visual page builder (Puck, say) is a better fit for that and can
+sit alongside `<GRepeater>` later — it would decide composition, while
+`<GRail>` still owns each block's leaf content.
+
+## Extending the toolbar
+
+The bundled toolbar (edit indicator, Team, Log out) has one extension point:
+
+```tsx
+withGuardrail(RootLayout, {
+  ...supabase,
+  siteId,
+  toolbarExtra: <a href="/orders">Orders</a>, // your JSX, your styling
+});
+```
+
+Plain content, not a component reference or a structured item list — same
+"expose the primitive, developer owns the styling" rule as `onInvite`.
+
+## Reading a value without rendering it
+
+`<GRail>` always renders something. For the cases where the final markup has
+to be something Guardrail doesn't produce — an embed iframe's `src`, an
+`og:image` meta tag, structured data — `getFieldValue` reads the same stored
+value with no markup attached:
+
+```tsx
+const video = await getFieldValue("hero.video");
+// video?.href — build your own <iframe src={video.href}> from it
+```
+
+It's read-only: give the same id a normal `<GRail>` somewhere so an editor can
+change it. `getFieldValue` returns `null` until something is saved — there's
+no `children` to fall back to when nothing is rendered — so supply your own
+default. It shares `<GRail>`'s batching, so calling it alongside other fields
+(including several via `Promise.all`) still resolves in one query.
+
+## Custom adapters
+
+Guardrail defaults to Supabase. To use another backend, implement `GRDBAdapter`
+and `GRAuthAdapter` and pass them to `withGuardrail`:
+
+```tsx
+export default withGuardrail(RootLayout, {
+  db: new MyDBAdapter(),
+  auth: new MyAuthAdapter(),
+  siteId: "my-site",
+});
+```
+
+Only `getSession()` and `logout()` are required. `authenticate` is optional —
+adapters built on magic links, SSO, or a hosted sign-in page omit it and set
+`signInUrl`, and Guardrail links there instead of rendering a password form it
+cannot fulfil. `inviteUser` is optional too; without it, invites fall back to
+your `onInvite` callback.
+
+```ts
+const clerkAuth: GRAuthAdapter = {
+  getSession: async () => { /* ... */ },
+  logout: async () => { /* ... */ },
+  signInUrl: "/sign-in",   // no password form; Guardrail links here
+};
+```
+
+`getSession()` is the sole authorization check for writes. It must validate the
+session against the provider — never trust the presence of a cookie.
+
+`getOverrides(pathKeys, siteId)` is batched by design — it receives every key a
+render pass needs, already deduplicated. Adapters map their own storage naming
+at this boundary; core speaks `pathKey` / `siteId` only.
+
+## Performance
+
+Fields are resolved through a request-scoped batching loader: every `<GRail>`
+rendered in the same pass is collected and fetched in a single query. Set
+`GUARDRAIL_DEBUG=1` to log how many keys each batch resolved.
+
+## Known limitations
+
+- `withGuardrail` reads cookies in the root layout, which opts routes into
+  dynamic rendering. See the repo README for the plan.
+- Saving revalidates the entire layout tree rather than the affected route.
+- No drafts, revisions, or scheduled publishing. Saves are live.

package/dist/adapters/supabase/auth.d.ts

@@ -0,0 +1,9 @@
+import { SupabaseCredentials } from './client.js';
+import { GRAuthAdapter } from '../../core/adapter-types.js';
+import '@supabase/supabase-js';
+import 'react';
+import '../../core/types.js';
+
+declare function supabaseAuth(creds: SupabaseCredentials): GRAuthAdapter;
+
+export { supabaseAuth };

package/dist/adapters/supabase/auth.js

@@ -0,0 +1,57 @@
+import { anonClient, assertCredentials, sessionClient } from "./client";
+function supabaseAuth(creds) {
+  assertCredentials(creds);
+  return {
+    async authenticate(email, password) {
+      const client = await sessionClient(creds);
+      const { data, error } = await client.auth.signInWithPassword({
+        email,
+        password
+      });
+      if (error) return { success: false, error: error.message };
+      if (!data.user) return { success: false, error: "User not found." };
+      return {
+        success: true,
+        session: { userId: data.user.id, email: data.user.email }
+      };
+    },
+    /**
+     * Uses getUser(), which revalidates the JWT against the Supabase auth
+     * server. getSession() only decodes the cookie, so it would trust a forged
+     * token.
+     */
+    async getSession() {
+      const client = await sessionClient(creds);
+      const { data, error } = await client.auth.getUser();
+      if (error || !data.user) return null;
+      return { userId: data.user.id, email: data.user.email };
+    },
+    /**
+     * Sends a sign-in link that creates the account on first use.
+     *
+     * Requested through the cookie-free client on purpose. A session client
+     * would use PKCE and drop the code verifier into the *admin's* browser,
+     * so the link would fail when the invitee opened it anywhere else. The
+     * email template must point at the confirm route with {{ .TokenHash }},
+     * which verifies server-side and needs no verifier.
+     */
+    async inviteUser(email, options) {
+      const { error } = await anonClient(creds).auth.signInWithOtp({
+        email,
+        options: {
+          shouldCreateUser: true,
+          ...options?.redirectTo ? { emailRedirectTo: options.redirectTo } : {}
+        }
+      });
+      return error ? { success: false, error: error.message } : { success: true };
+    },
+    async logout() {
+      const client = await sessionClient(creds);
+      await client.auth.signOut();
+    }
+  };
+}
+export {
+  supabaseAuth
+};
+//# sourceMappingURL=auth.js.map

package/dist/adapters/supabase/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/supabase/auth.ts"],"sourcesContent":["import { anonClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport type { GRAuthAdapter, GRSession } from \"../../core/adapter-types\";\n\nexport function supabaseAuth(creds: SupabaseCredentials): GRAuthAdapter {\n  assertCredentials(creds);\n\n  return {\n    async authenticate(email, password) {\n      const client = await sessionClient(creds);\n      const { data, error } = await client.auth.signInWithPassword({\n        email,\n        password,\n      });\n\n      if (error) return { success: false, error: error.message };\n      if (!data.user) return { success: false, error: \"User not found.\" };\n\n      return {\n        success: true,\n        session: { userId: data.user.id, email: data.user.email },\n      };\n    },\n\n    /**\n     * Uses getUser(), which revalidates the JWT against the Supabase auth\n     * server. getSession() only decodes the cookie, so it would trust a forged\n     * token.\n     */\n    async getSession(): Promise<GRSession | null> {\n      const client = await sessionClient(creds);\n      const { data, error } = await client.auth.getUser();\n      if (error || !data.user) return null;\n      return { userId: data.user.id, email: data.user.email };\n    },\n\n    /**\n     * Sends a sign-in link that creates the account on first use.\n     *\n     * Requested through the cookie-free client on purpose. A session client\n     * would use PKCE and drop the code verifier into the *admin's* browser,\n     * so the link would fail when the invitee opened it anywhere else. The\n     * email template must point at the confirm route with {{ .TokenHash }},\n     * which verifies server-side and needs no verifier.\n     */\n    async inviteUser(email, options) {\n      const { error } = await anonClient(creds).auth.signInWithOtp({\n        email,\n        options: {\n          shouldCreateUser: true,\n          ...(options?.redirectTo ? { emailRedirectTo: options.redirectTo } : {}),\n        },\n      });\n      return error\n        ? { success: false, error: error.message }\n        : { success: true };\n    },\n\n    async logout() {\n      const client = await sessionClient(creds);\n      await client.auth.signOut();\n    },\n  };\n}\n"],"mappings":"AAAA,SAAS,YAAY,mBAAmB,qBAAqB;AAItD,SAAS,aAAa,OAA2C;AACtE,oBAAkB,KAAK;AAEvB,SAAO;AAAA,IACL,MAAM,aAAa,OAAO,UAAU;AAClC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK,mBAAmB;AAAA,QAC3D;AAAA,QACA;AAAA,MACF,CAAC;AAED,UAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AACzD,UAAI,CAAC,KAAK,KAAM,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAElE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,EAAE,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM;AAAA,MAC1D;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,aAAwC;AAC5C,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK,QAAQ;AAClD,UAAI,SAAS,CAAC,KAAK,KAAM,QAAO;AAChC,aAAO,EAAE,QAAQ,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,MAAM;AAAA,IACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWA,MAAM,WAAW,OAAO,SAAS;AAC/B,YAAM,EAAE,MAAM,IAAI,MAAM,WAAW,KAAK,EAAE,KAAK,cAAc;AAAA,QAC3D;AAAA,QACA,SAAS;AAAA,UACP,kBAAkB;AAAA,UAClB,GAAI,SAAS,aAAa,EAAE,iBAAiB,QAAQ,WAAW,IAAI,CAAC;AAAA,QACvE;AAAA,MACF,CAAC;AACD,aAAO,QACH,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IACvC,EAAE,SAAS,KAAK;AAAA,IACtB;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,OAAO,KAAK,QAAQ;AAAA,IAC5B;AAAA,EACF;AACF;","names":[]}

package/dist/adapters/supabase/client.d.ts

@@ -0,0 +1,28 @@
+import { SupabaseClient } from '@supabase/supabase-js';
+
+/**
+ * Credentials are passed in, never read from process.env here.
+ *
+ * An adapter that reaches into the environment hides its own requirements —
+ * nothing in the type signature says which vars must exist, so a missing or
+ * stale one surfaces as a runtime fetch failure. It also makes two sites on
+ * two different projects impossible, since the credentials become global.
+ */
+interface SupabaseCredentials {
+    url: string;
+    anonKey: string;
+}
+declare function assertCredentials(creds: SupabaseCredentials): void;
+/**
+ * Cookie-free client for reads. A single cookies() call in the render path
+ * opts the whole route out of static generation, so public content reads must
+ * never touch them.
+ */
+declare function anonClient(creds: SupabaseCredentials): SupabaseClient;
+/**
+ * Request-scoped client carrying the editor's auth cookies, so writes run as
+ * the signed-in user and RLS can enforce authorization independently.
+ */
+declare function sessionClient(creds: SupabaseCredentials): Promise<SupabaseClient>;
+
+export { type SupabaseCredentials, anonClient, assertCredentials, sessionClient };

package/dist/adapters/supabase/client.js

@@ -0,0 +1,44 @@
+import { createServerClient } from "@supabase/ssr";
+import { createClient } from "@supabase/supabase-js";
+import { cookies } from "next/headers";
+function assertCredentials(creds) {
+  if (!creds?.url || !creds?.anonKey) {
+    throw new Error(
+      "Guardrail (Supabase): both `url` and `anonKey` are required."
+    );
+  }
+}
+const anonClients = /* @__PURE__ */ new Map();
+function anonClient(creds) {
+  const key = `${creds.url}::${creds.anonKey}`;
+  let client = anonClients.get(key);
+  if (!client) {
+    client = createClient(creds.url, creds.anonKey, {
+      auth: { persistSession: false, autoRefreshToken: false }
+    });
+    anonClients.set(key, client);
+  }
+  return client;
+}
+async function sessionClient(creds) {
+  const cookieStore = await cookies();
+  return createServerClient(creds.url, creds.anonKey, {
+    cookies: {
+      getAll: () => cookieStore.getAll(),
+      setAll: (cookiesToSet) => {
+        try {
+          cookiesToSet.forEach(
+            ({ name, value, options }) => cookieStore.set(name, value, options)
+          );
+        } catch {
+        }
+      }
+    }
+  });
+}
+export {
+  anonClient,
+  assertCredentials,
+  sessionClient
+};
+//# sourceMappingURL=client.js.map

package/dist/adapters/supabase/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/supabase/client.ts"],"sourcesContent":["import { createServerClient } from \"@supabase/ssr\";\nimport { createClient, type SupabaseClient } from \"@supabase/supabase-js\";\nimport { cookies } from \"next/headers\";\n\n/**\n * Credentials are passed in, never read from process.env here.\n *\n * An adapter that reaches into the environment hides its own requirements —\n * nothing in the type signature says which vars must exist, so a missing or\n * stale one surfaces as a runtime fetch failure. It also makes two sites on\n * two different projects impossible, since the credentials become global.\n */\nexport interface SupabaseCredentials {\n  url: string;\n  anonKey: string;\n}\n\nexport function assertCredentials(creds: SupabaseCredentials): void {\n  if (!creds?.url || !creds?.anonKey) {\n    throw new Error(\n      \"Guardrail (Supabase): both `url` and `anonKey` are required.\",\n    );\n  }\n}\n\nconst anonClients = new Map<string, SupabaseClient>();\n\n/**\n * Cookie-free client for reads. A single cookies() call in the render path\n * opts the whole route out of static generation, so public content reads must\n * never touch them.\n */\nexport function anonClient(creds: SupabaseCredentials): SupabaseClient {\n  const key = `${creds.url}::${creds.anonKey}`;\n  let client = anonClients.get(key);\n  if (!client) {\n    client = createClient(creds.url, creds.anonKey, {\n      auth: { persistSession: false, autoRefreshToken: false },\n    });\n    anonClients.set(key, client);\n  }\n  return client;\n}\n\n/**\n * Request-scoped client carrying the editor's auth cookies, so writes run as\n * the signed-in user and RLS can enforce authorization independently.\n */\nexport async function sessionClient(\n  creds: SupabaseCredentials,\n): Promise<SupabaseClient> {\n  const cookieStore = await cookies();\n\n  return createServerClient(creds.url, creds.anonKey, {\n    cookies: {\n      getAll: () => cookieStore.getAll(),\n      setAll: (cookiesToSet) => {\n        try {\n          cookiesToSet.forEach(({ name, value, options }) =>\n            cookieStore.set(name, value, options),\n          );\n        } catch {\n          // Read-only cookies in a Server Component; safe to ignore when a\n          // Server Action or middleware refreshes the session.\n        }\n      },\n    },\n  });\n}\n"],"mappings":"AAAA,SAAS,0BAA0B;AACnC,SAAS,oBAAyC;AAClD,SAAS,eAAe;AAejB,SAAS,kBAAkB,OAAkC;AAClE,MAAI,CAAC,OAAO,OAAO,CAAC,OAAO,SAAS;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,cAAc,oBAAI,IAA4B;AAO7C,SAAS,WAAW,OAA4C;AACrE,QAAM,MAAM,GAAG,MAAM,GAAG,KAAK,MAAM,OAAO;AAC1C,MAAI,SAAS,YAAY,IAAI,GAAG;AAChC,MAAI,CAAC,QAAQ;AACX,aAAS,aAAa,MAAM,KAAK,MAAM,SAAS;AAAA,MAC9C,MAAM,EAAE,gBAAgB,OAAO,kBAAkB,MAAM;AAAA,IACzD,CAAC;AACD,gBAAY,IAAI,KAAK,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,eAAsB,cACpB,OACyB;AACzB,QAAM,cAAc,MAAM,QAAQ;AAElC,SAAO,mBAAmB,MAAM,KAAK,MAAM,SAAS;AAAA,IAClD,SAAS;AAAA,MACP,QAAQ,MAAM,YAAY,OAAO;AAAA,MACjC,QAAQ,CAAC,iBAAiB;AACxB,YAAI;AACF,uBAAa;AAAA,YAAQ,CAAC,EAAE,MAAM,OAAO,QAAQ,MAC3C,YAAY,IAAI,MAAM,OAAO,OAAO;AAAA,UACtC;AAAA,QACF,QAAQ;AAAA,QAGR;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/adapters/supabase/confirm.d.ts

@@ -0,0 +1,19 @@
+import { SupabaseCredentials } from './client.js';
+import '@supabase/supabase-js';
+
+/**
+ * Route handler that turns an emailed link into a session.
+ *
+ * Mount it in the app:
+ *   // app/guardrail/confirm/route.ts
+ *   export const GET = supabaseConfirmRoute({ url, anonKey });
+ *
+ * verifyOtp with a token_hash works in whichever browser opens the link, unlike
+ * a PKCE code exchange. Once the session cookie is set, the next render claims
+ * any pending invitation addressed to that email.
+ */
+declare function supabaseConfirmRoute(creds: SupabaseCredentials, options?: {
+    next?: string;
+}): (request: Request) => Promise<Response>;
+
+export { supabaseConfirmRoute };

package/dist/adapters/supabase/confirm.js

@@ -0,0 +1,27 @@
+import { redirect } from "next/navigation";
+import { assertCredentials, sessionClient } from "./client";
+function safePath(value, fallback) {
+  if (!value || !value.startsWith("/") || value.startsWith("//")) return fallback;
+  return value;
+}
+function supabaseConfirmRoute(creds, options = {}) {
+  assertCredentials(creds);
+  const fallback = options.next ?? "/?edit=true";
+  return async function GET(request) {
+    const url = new URL(request.url);
+    const tokenHash = url.searchParams.get("token_hash");
+    const type = url.searchParams.get("type");
+    const next = safePath(url.searchParams.get("next"), fallback);
+    if (tokenHash && type) {
+      const client = await sessionClient(creds);
+      const { error } = await client.auth.verifyOtp({ type, token_hash: tokenHash });
+      if (!error) redirect(next);
+      console.error("Guardrail (Supabase): link verification failed", error.message);
+    }
+    redirect(`${fallback}${fallback.includes("?") ? "&" : "?"}gr_auth_error=link`);
+  };
+}
+export {
+  supabaseConfirmRoute
+};
+//# sourceMappingURL=confirm.js.map

package/dist/adapters/supabase/confirm.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/supabase/confirm.ts"],"sourcesContent":["import type { EmailOtpType } from \"@supabase/supabase-js\";\nimport { redirect } from \"next/navigation\";\nimport { assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\n\n/**\n * Only same-origin paths. Accepting an arbitrary `next` would make this route\n * an open redirect — a signed-in link on your domain that forwards anywhere.\n */\nfunction safePath(value: string | null, fallback: string): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\")) return fallback;\n  return value;\n}\n\n/**\n * Route handler that turns an emailed link into a session.\n *\n * Mount it in the app:\n *   // app/guardrail/confirm/route.ts\n *   export const GET = supabaseConfirmRoute({ url, anonKey });\n *\n * verifyOtp with a token_hash works in whichever browser opens the link, unlike\n * a PKCE code exchange. Once the session cookie is set, the next render claims\n * any pending invitation addressed to that email.\n */\nexport function supabaseConfirmRoute(\n  creds: SupabaseCredentials,\n  options: { next?: string } = {},\n) {\n  assertCredentials(creds);\n  const fallback = options.next ?? \"/?edit=true\";\n\n  return async function GET(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const tokenHash = url.searchParams.get(\"token_hash\");\n    const type = url.searchParams.get(\"type\") as EmailOtpType | null;\n    const next = safePath(url.searchParams.get(\"next\"), fallback);\n\n    if (tokenHash && type) {\n      const client = await sessionClient(creds);\n      const { error } = await client.auth.verifyOtp({ type, token_hash: tokenHash });\n      if (!error) redirect(next);\n      console.error(\"Guardrail (Supabase): link verification failed\", error.message);\n    }\n\n    redirect(`${fallback}${fallback.includes(\"?\") ? \"&\" : \"?\"}gr_auth_error=link`);\n  };\n}\n"],"mappings":"AACA,SAAS,gBAAgB;AACzB,SAAS,mBAAmB,qBAAqB;AAOjD,SAAS,SAAS,OAAsB,UAA0B;AAChE,MAAI,CAAC,SAAS,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,EAAG,QAAO;AACvE,SAAO;AACT;AAaO,SAAS,qBACd,OACA,UAA6B,CAAC,GAC9B;AACA,oBAAkB,KAAK;AACvB,QAAM,WAAW,QAAQ,QAAQ;AAEjC,SAAO,eAAe,IAAI,SAAqC;AAC7D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,YAAY,IAAI,aAAa,IAAI,YAAY;AACnD,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,OAAO,SAAS,IAAI,aAAa,IAAI,MAAM,GAAG,QAAQ;AAE5D,QAAI,aAAa,MAAM;AACrB,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OAAO,KAAK,UAAU,EAAE,MAAM,YAAY,UAAU,CAAC;AAC7E,UAAI,CAAC,MAAO,UAAS,IAAI;AACzB,cAAQ,MAAM,kDAAkD,MAAM,OAAO;AAAA,IAC/E;AAEA,aAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,oBAAoB;AAAA,EAC/E;AACF;","names":[]}

package/dist/adapters/supabase/db.d.ts

@@ -0,0 +1,9 @@
+import { SupabaseCredentials } from './client.js';
+import { GRDBAdapter } from '../../core/adapter-types.js';
+import '@supabase/supabase-js';
+import 'react';
+import '../../core/types.js';
+
+declare function supabaseDB(creds: SupabaseCredentials): GRDBAdapter;
+
+export { supabaseDB };

package/dist/adapters/supabase/db.js

@@ -0,0 +1,49 @@
+import { anonClient, assertCredentials, sessionClient } from "./client";
+import { GR_SCHEMA, GR_TABLE } from "../../core/defs";
+function toOverrideRow(row) {
+  return {
+    id: row.id,
+    pathKey: row.path_key,
+    // Some drivers hand back jsonb columns as strings.
+    value: typeof row.value === "string" ? JSON.parse(row.value) : row.value
+  };
+}
+function supabaseDB(creds) {
+  assertCredentials(creds);
+  return {
+    async getOverrides(pathKeys, siteId) {
+      if (pathKeys.length === 0) return [];
+      const { data, error } = await anonClient(creds).schema(GR_SCHEMA).from(GR_TABLE).select("id, path_key, value").eq("site_id", siteId).in("path_key", pathKeys);
+      if (error) {
+        console.error("Guardrail (Supabase): read failed", error.message);
+        return [];
+      }
+      return (data ?? []).map(toOverrideRow);
+    },
+    async setOverride(row) {
+      const client = await sessionClient(creds);
+      const { error } = await client.schema(GR_SCHEMA).from(GR_TABLE).upsert(
+        {
+          path_key: row.pathKey,
+          site_id: row.siteId,
+          type: row.type,
+          value: row.value,
+          updated_at: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        { onConflict: "path_key,site_id" }
+      );
+      return error ? { success: false, error: error.message } : { success: true };
+    },
+    async deleteOverrides(pathKeyPrefix, siteId) {
+      const client = await sessionClient(creds);
+      const { error } = await client.schema(GR_SCHEMA).from(GR_TABLE).delete().eq("site_id", siteId).like("path_key", `${pathKeyPrefix}%`);
+      if (error) {
+        console.error("Guardrail (Supabase): deleteOverrides failed", error.message);
+      }
+    }
+  };
+}
+export {
+  supabaseDB
+};
+//# sourceMappingURL=db.js.map

package/dist/adapters/supabase/db.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/supabase/db.ts"],"sourcesContent":["import { anonClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport { GR_SCHEMA, GR_TABLE } from \"../../core/defs\";\nimport type { GRDBAdapter, GRStorageRow } from \"../../core/adapter-types\";\nimport type { OverrideRow, OverrideValue } from \"../../core/types\";\n\n/** Shape as stored in Postgres. Column naming stops at this boundary. */\ninterface ContentRow {\n  id: string;\n  path_key: string;\n  value: OverrideValue | string;\n}\n\nfunction toOverrideRow(row: ContentRow): OverrideRow {\n  return {\n    id: row.id,\n    pathKey: row.path_key,\n    // Some drivers hand back jsonb columns as strings.\n    value:\n      typeof row.value === \"string\"\n        ? (JSON.parse(row.value) as OverrideValue)\n        : row.value,\n  };\n}\n\nexport function supabaseDB(creds: SupabaseCredentials): GRDBAdapter {\n  assertCredentials(creds);\n\n  return {\n    async getOverrides(pathKeys, siteId) {\n      if (pathKeys.length === 0) return [];\n\n      // Anon client keeps the read path cookie-free so routes stay static.\n      const { data, error } = await anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        .in(\"path_key\", pathKeys);\n\n      if (error) {\n        console.error(\"Guardrail (Supabase): read failed\", error.message);\n        return [];\n      }\n      return ((data ?? []) as ContentRow[]).map(toOverrideRow);\n    },\n\n    async setOverride(row: GRStorageRow) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .upsert(\n          {\n            path_key: row.pathKey,\n            site_id: row.siteId,\n            type: row.type,\n            value: row.value,\n            updated_at: new Date().toISOString(),\n          },\n          { onConflict: \"path_key,site_id\" },\n        );\n      return error\n        ? { success: false, error: error.message }\n        : { success: true };\n    },\n\n    async deleteOverrides(pathKeyPrefix: string, siteId: string) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .delete()\n        .eq(\"site_id\", siteId)\n        .like(\"path_key\", `${pathKeyPrefix}%`);\n      if (error) {\n        console.error(\"Guardrail (Supabase): deleteOverrides failed\", error.message);\n      }\n    },\n  };\n}\n"],"mappings":"AAAA,SAAS,YAAY,mBAAmB,qBAAqB;AAE7D,SAAS,WAAW,gBAAgB;AAWpC,SAAS,cAAc,KAA8B;AACnD,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,SAAS,IAAI;AAAA;AAAA,IAEb,OACE,OAAO,IAAI,UAAU,WAChB,KAAK,MAAM,IAAI,KAAK,IACrB,IAAI;AAAA,EACZ;AACF;AAEO,SAAS,WAAW,OAAyC;AAClE,oBAAkB,KAAK;AAEvB,SAAO;AAAA,IACL,MAAM,aAAa,UAAU,QAAQ;AACnC,UAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAGnC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,WAAW,KAAK,EAC3C,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EACpB,GAAG,YAAY,QAAQ;AAE1B,UAAI,OAAO;AACT,gBAAQ,MAAM,qCAAqC,MAAM,OAAO;AAChE,eAAO,CAAC;AAAA,MACV;AACA,cAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAAA,IACzD;AAAA,IAEA,MAAM,YAAY,KAAmB;AACnC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb;AAAA,QACC;AAAA,UACE,UAAU,IAAI;AAAA,UACd,SAAS,IAAI;AAAA,UACb,MAAM,IAAI;AAAA,UACV,OAAO,IAAI;AAAA,UACX,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACrC;AAAA,QACA,EAAE,YAAY,mBAAmB;AAAA,MACnC;AACF,aAAO,QACH,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IACvC,EAAE,SAAS,KAAK;AAAA,IACtB;AAAA,IAEA,MAAM,gBAAgB,eAAuB,QAAgB;AAC3D,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,EACP,GAAG,WAAW,MAAM,EACpB,KAAK,YAAY,GAAG,aAAa,GAAG;AACvC,UAAI,OAAO;AACT,gBAAQ,MAAM,gDAAgD,MAAM,OAAO;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/adapters/supabase/index.d.ts

@@ -0,0 +1,25 @@
+import { GRDBAdapter, GRAuthAdapter, GRMembershipAdapter, GRRepeaterAdapter } from '../../core/adapter-types.js';
+export { supabaseDB } from './db.js';
+export { supabaseAuth } from './auth.js';
+export { supabaseMembers } from './members.js';
+export { supabaseConfirmRoute } from './confirm.js';
+export { DEFAULT_BUCKET, SupabaseStorageOptions, supabaseStorage } from './storage.js';
+export { supabaseRepeaters } from './repeaters.js';
+import { SupabaseCredentials } from './client.js';
+import 'react';
+import '../../core/types.js';
+import '@supabase/supabase-js';
+
+/**
+ * All three slots backed by one Supabase project. Use the individual factories
+ * instead when mixing backends — Supabase for content, another provider for
+ * identity, say.
+ */
+declare function supabaseAdapters(creds: SupabaseCredentials): {
+    db: GRDBAdapter;
+    auth: GRAuthAdapter;
+    members: GRMembershipAdapter;
+    repeaters: GRRepeaterAdapter;
+};
+
+export { SupabaseCredentials, supabaseAdapters };