@guard-rail/core 0.1.0

package/dist/adapters/supabase/index.js

@@ -0,0 +1,29 @@
+import { supabaseDB } from "./db";
+import { supabaseAuth } from "./auth";
+import { supabaseMembers } from "./members";
+import { supabaseConfirmRoute } from "./confirm";
+import { supabaseStorage, DEFAULT_BUCKET } from "./storage";
+import { supabaseRepeaters } from "./repeaters";
+import { supabaseDB as supabaseDB2 } from "./db";
+import { supabaseAuth as supabaseAuth2 } from "./auth";
+import { supabaseMembers as supabaseMembers2 } from "./members";
+import { supabaseRepeaters as supabaseRepeaters2 } from "./repeaters";
+function supabaseAdapters(creds) {
+  return {
+    db: supabaseDB2(creds),
+    auth: supabaseAuth2(creds),
+    members: supabaseMembers2(creds),
+    repeaters: supabaseRepeaters2(creds)
+  };
+}
+export {
+  DEFAULT_BUCKET,
+  supabaseAdapters,
+  supabaseAuth,
+  supabaseConfirmRoute,
+  supabaseDB,
+  supabaseMembers,
+  supabaseRepeaters,
+  supabaseStorage
+};
+//# sourceMappingURL=index.js.map

package/dist/adapters/supabase/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/supabase/index.ts"],"sourcesContent":["export { supabaseDB } from \"./db\";\nexport { supabaseAuth } from \"./auth\";\nexport { supabaseMembers } from \"./members\";\nexport { supabaseConfirmRoute } from \"./confirm\";\nexport { supabaseStorage, DEFAULT_BUCKET } from \"./storage\";\nexport { supabaseRepeaters } from \"./repeaters\";\nexport type { SupabaseStorageOptions } from \"./storage\";\nexport type { SupabaseCredentials } from \"./client\";\n\nimport { supabaseDB } from \"./db\";\nimport { supabaseAuth } from \"./auth\";\nimport { supabaseMembers } from \"./members\";\nimport { supabaseRepeaters } from \"./repeaters\";\nimport type { SupabaseCredentials } from \"./client\";\n\n/**\n * All three slots backed by one Supabase project. Use the individual factories\n * instead when mixing backends — Supabase for content, another provider for\n * identity, say.\n */\nexport function supabaseAdapters(creds: SupabaseCredentials) {\n  return {\n    db: supabaseDB(creds),\n    auth: supabaseAuth(creds),\n    members: supabaseMembers(creds),\n    repeaters: supabaseRepeaters(creds),\n  };\n}\n"],"mappings":"AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AACrC,SAAS,iBAAiB,sBAAsB;AAChD,SAAS,yBAAyB;AAIlC,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,qBAAAC,0BAAyB;AAQ3B,SAAS,iBAAiB,OAA4B;AAC3D,SAAO;AAAA,IACL,IAAIH,YAAW,KAAK;AAAA,IACpB,MAAMC,cAAa,KAAK;AAAA,IACxB,SAASC,iBAAgB,KAAK;AAAA,IAC9B,WAAWC,mBAAkB,KAAK;AAAA,EACpC;AACF;","names":["supabaseDB","supabaseAuth","supabaseMembers","supabaseRepeaters"]}

package/dist/adapters/supabase/members.d.ts

@@ -0,0 +1,9 @@
+import { SupabaseCredentials } from './client.js';
+import { GRMembershipAdapter } from '../../core/adapter-types.js';
+import '@supabase/supabase-js';
+import 'react';
+import '../../core/types.js';
+
+declare function supabaseMembers(creds: SupabaseCredentials): GRMembershipAdapter;
+
+export { supabaseMembers };

package/dist/adapters/supabase/members.js

@@ -0,0 +1,73 @@
+import { assertCredentials, sessionClient } from "./client";
+import { GR_MEMBERS_TABLE, GR_SCHEMA } from "../../core/defs";
+function toMember(row) {
+  return {
+    userId: row.user_id,
+    email: row.email,
+    role: row.role,
+    status: row.status,
+    ...row.invited_at ? { invitedAt: row.invited_at } : {}
+  };
+}
+const COLUMNS = "user_id, email, role, status, invited_at";
+function supabaseMembers(creds) {
+  assertCredentials(creds);
+  return {
+    async getMember(siteId, lookup) {
+      const client = await sessionClient(creds);
+      let query = client.schema(GR_SCHEMA).from(GR_MEMBERS_TABLE).select(COLUMNS).eq("site_id", siteId);
+      if (lookup.userId) query = query.eq("user_id", lookup.userId);
+      else if (lookup.email)
+        query = query.eq("email", lookup.email.toLowerCase().trim());
+      else return null;
+      const { data, error } = await query.maybeSingle();
+      if (error) {
+        console.error("Guardrail (Supabase): member lookup failed", error.message);
+        return null;
+      }
+      return data ? toMember(data) : null;
+    },
+    async listMembers(siteId) {
+      const client = await sessionClient(creds);
+      const { data, error } = await client.schema(GR_SCHEMA).from(GR_MEMBERS_TABLE).select(COLUMNS).eq("site_id", siteId).order("email");
+      if (error) {
+        console.error("Guardrail (Supabase): list members failed", error.message);
+        return [];
+      }
+      return (data ?? []).map(toMember);
+    },
+    async upsertMember(siteId, member) {
+      const client = await sessionClient(creds);
+      const { error } = await client.schema(GR_SCHEMA).from(GR_MEMBERS_TABLE).upsert(
+        {
+          site_id: siteId,
+          email: member.email.toLowerCase().trim(),
+          role: member.role,
+          user_id: member.userId ?? null,
+          status: member.status,
+          invited_at: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        { onConflict: "site_id,email" }
+      );
+      return error ? { success: false, error: error.message } : { success: true };
+    },
+    async removeMember(siteId, email) {
+      const client = await sessionClient(creds);
+      const { error } = await client.schema(GR_SCHEMA).from(GR_MEMBERS_TABLE).delete().eq("site_id", siteId).eq("email", email.toLowerCase().trim());
+      return error ? { success: false, error: error.message } : { success: true };
+    },
+    async claimInvite(siteId) {
+      const client = await sessionClient(creds);
+      const { error } = await client.schema(GR_SCHEMA).rpc("gr_claim_invite", {
+        target_site: siteId
+      });
+      if (error) {
+        console.error("Guardrail (Supabase): claim failed", error.message);
+      }
+    }
+  };
+}
+export {
+  supabaseMembers
+};
+//# sourceMappingURL=members.js.map

package/dist/adapters/supabase/members.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/supabase/members.ts"],"sourcesContent":["import { assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport { GR_MEMBERS_TABLE, GR_SCHEMA } from \"../../core/defs\";\nimport type { GRMembershipAdapter } from \"../../core/adapter-types\";\nimport type { GRMember, GRRole } from \"../../core/types\";\n\ninterface MemberRow {\n  user_id: string | null;\n  email: string;\n  role: GRRole;\n  status: \"active\" | \"pending\";\n  invited_at: string | null;\n}\n\nfunction toMember(row: MemberRow): GRMember {\n  return {\n    userId: row.user_id,\n    email: row.email,\n    role: row.role,\n    status: row.status,\n    ...(row.invited_at ? { invitedAt: row.invited_at } : {}),\n  };\n}\n\nconst COLUMNS = \"user_id, email, role, status, invited_at\";\n\nexport function supabaseMembers(\n  creds: SupabaseCredentials,\n): GRMembershipAdapter {\n  assertCredentials(creds);\n\n  return {\n    async getMember(siteId, lookup) {\n      // Session-bound by necessity: RLS evaluates auth.uid(), so the anon\n      // client would see nothing and every role would resolve to null.\n      const client = await sessionClient(creds);\n      let query = client\n        .schema(GR_SCHEMA)\n        .from(GR_MEMBERS_TABLE)\n        .select(COLUMNS)\n        .eq(\"site_id\", siteId);\n\n      if (lookup.userId) query = query.eq(\"user_id\", lookup.userId);\n      else if (lookup.email)\n        query = query.eq(\"email\", lookup.email.toLowerCase().trim());\n      else return null;\n\n      const { data, error } = await query.maybeSingle();\n      if (error) {\n        console.error(\"Guardrail (Supabase): member lookup failed\", error.message);\n        return null;\n      }\n      return data ? toMember(data as MemberRow) : null;\n    },\n\n    async listMembers(siteId) {\n      const client = await sessionClient(creds);\n      const { data, error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_MEMBERS_TABLE)\n        .select(COLUMNS)\n        .eq(\"site_id\", siteId)\n        .order(\"email\");\n\n      if (error) {\n        console.error(\"Guardrail (Supabase): list members failed\", error.message);\n        return [];\n      }\n      return ((data ?? []) as MemberRow[]).map(toMember);\n    },\n\n    async upsertMember(siteId, member) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_MEMBERS_TABLE)\n        .upsert(\n          {\n            site_id: siteId,\n            email: member.email.toLowerCase().trim(),\n            role: member.role,\n            user_id: member.userId ?? null,\n            status: member.status,\n            invited_at: new Date().toISOString(),\n          },\n          { onConflict: \"site_id,email\" },\n        );\n      return error\n        ? { success: false, error: error.message }\n        : { success: true };\n    },\n\n    async removeMember(siteId, email) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_MEMBERS_TABLE)\n        .delete()\n        .eq(\"site_id\", siteId)\n        .eq(\"email\", email.toLowerCase().trim());\n      return error\n        ? { success: false, error: error.message }\n        : { success: true };\n    },\n\n    async claimInvite(siteId) {\n      const client = await sessionClient(creds);\n      // SECURITY DEFINER function: sets user_id/status on a pending row\n      // matching the caller's own email, and cannot alter the invited role.\n      const { error } = await client.schema(GR_SCHEMA).rpc(\"gr_claim_invite\", {\n        target_site: siteId,\n      });\n      if (error) {\n        console.error(\"Guardrail (Supabase): claim failed\", error.message);\n      }\n    },\n  };\n}\n"],"mappings":"AAAA,SAAS,mBAAmB,qBAAqB;AAEjD,SAAS,kBAAkB,iBAAiB;AAY5C,SAAS,SAAS,KAA0B;AAC1C,SAAO;AAAA,IACL,QAAQ,IAAI;AAAA,IACZ,OAAO,IAAI;AAAA,IACX,MAAM,IAAI;AAAA,IACV,QAAQ,IAAI;AAAA,IACZ,GAAI,IAAI,aAAa,EAAE,WAAW,IAAI,WAAW,IAAI,CAAC;AAAA,EACxD;AACF;AAEA,MAAM,UAAU;AAET,SAAS,gBACd,OACqB;AACrB,oBAAkB,KAAK;AAEvB,SAAO;AAAA,IACL,MAAM,UAAU,QAAQ,QAAQ;AAG9B,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,UAAI,QAAQ,OACT,OAAO,SAAS,EAChB,KAAK,gBAAgB,EACrB,OAAO,OAAO,EACd,GAAG,WAAW,MAAM;AAEvB,UAAI,OAAO,OAAQ,SAAQ,MAAM,GAAG,WAAW,OAAO,MAAM;AAAA,eACnD,OAAO;AACd,gBAAQ,MAAM,GAAG,SAAS,OAAO,MAAM,YAAY,EAAE,KAAK,CAAC;AAAA,UACxD,QAAO;AAEZ,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,MAAM,YAAY;AAChD,UAAI,OAAO;AACT,gBAAQ,MAAM,8CAA8C,MAAM,OAAO;AACzE,eAAO;AAAA,MACT;AACA,aAAO,OAAO,SAAS,IAAiB,IAAI;AAAA,IAC9C;AAAA,IAEA,MAAM,YAAY,QAAQ;AACxB,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAC3B,OAAO,SAAS,EAChB,KAAK,gBAAgB,EACrB,OAAO,OAAO,EACd,GAAG,WAAW,MAAM,EACpB,MAAM,OAAO;AAEhB,UAAI,OAAO;AACT,gBAAQ,MAAM,6CAA6C,MAAM,OAAO;AACxE,eAAO,CAAC;AAAA,MACV;AACA,cAAS,QAAQ,CAAC,GAAmB,IAAI,QAAQ;AAAA,IACnD;AAAA,IAEA,MAAM,aAAa,QAAQ,QAAQ;AACjC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,gBAAgB,EACrB;AAAA,QACC;AAAA,UACE,SAAS;AAAA,UACT,OAAO,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,UACvC,MAAM,OAAO;AAAA,UACb,SAAS,OAAO,UAAU;AAAA,UAC1B,QAAQ,OAAO;AAAA,UACf,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACrC;AAAA,QACA,EAAE,YAAY,gBAAgB;AAAA,MAChC;AACF,aAAO,QACH,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IACvC,EAAE,SAAS,KAAK;AAAA,IACtB;AAAA,IAEA,MAAM,aAAa,QAAQ,OAAO;AAChC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,gBAAgB,EACrB,OAAO,EACP,GAAG,WAAW,MAAM,EACpB,GAAG,SAAS,MAAM,YAAY,EAAE,KAAK,CAAC;AACzC,aAAO,QACH,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IACvC,EAAE,SAAS,KAAK;AAAA,IACtB;AAAA,IAEA,MAAM,YAAY,QAAQ;AACxB,YAAM,SAAS,MAAM,cAAc,KAAK;AAGxC,YAAM,EAAE,MAAM,IAAI,MAAM,OAAO,OAAO,SAAS,EAAE,IAAI,mBAAmB;AAAA,QACtE,aAAa;AAAA,MACf,CAAC;AACD,UAAI,OAAO;AACT,gBAAQ,MAAM,sCAAsC,MAAM,OAAO;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/adapters/supabase/repeaters.d.ts

@@ -0,0 +1,9 @@
+import { SupabaseCredentials } from './client.js';
+import { GRRepeaterAdapter } from '../../core/adapter-types.js';
+import '@supabase/supabase-js';
+import 'react';
+import '../../core/types.js';
+
+declare function supabaseRepeaters(creds: SupabaseCredentials): GRRepeaterAdapter;
+
+export { supabaseRepeaters };

package/dist/adapters/supabase/repeaters.js

@@ -0,0 +1,73 @@
+import { anonClient, assertCredentials, sessionClient } from "./client";
+import { GR_REPEATER_TABLE, GR_SCHEMA } from "../../core/defs";
+function toItem(row) {
+  return {
+    id: row.item_id,
+    order: row.sort_order,
+    ...row.slug ? { slug: row.slug } : {}
+  };
+}
+const SLUG = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+function supabaseRepeaters(creds) {
+  assertCredentials(creds);
+  return {
+    async listItems(repeaterId, siteId) {
+      const { data, error } = await anonClient(creds).schema(GR_SCHEMA).from(GR_REPEATER_TABLE).select("item_id, slug, sort_order").eq("site_id", siteId).eq("repeater_id", repeaterId).order("sort_order", { ascending: true });
+      if (error) {
+        console.error("Guardrail (Supabase): list repeater items failed", error.message);
+        return [];
+      }
+      return (data ?? []).map(toItem);
+    },
+    async getItemBySlug(repeaterId, siteId, slug) {
+      const { data, error } = await anonClient(creds).schema(GR_SCHEMA).from(GR_REPEATER_TABLE).select("item_id, slug, sort_order").eq("site_id", siteId).eq("repeater_id", repeaterId).eq("slug", slug).maybeSingle();
+      if (error) {
+        console.error("Guardrail (Supabase): repeater item lookup failed", error.message);
+        return null;
+      }
+      return data ? toItem(data) : null;
+    },
+    async addItem(repeaterId, siteId, options) {
+      if (options?.slug && !SLUG.test(options.slug)) {
+        return { success: false, error: "Invalid slug." };
+      }
+      const client = await sessionClient(creds);
+      const table = client.schema(GR_SCHEMA).from(GR_REPEATER_TABLE);
+      const { data: maxRow } = await table.select("sort_order").eq("site_id", siteId).eq("repeater_id", repeaterId).order("sort_order", { ascending: false }).limit(1).maybeSingle();
+      const nextOrder = (maxRow?.sort_order ?? -1) + 1;
+      const itemId = crypto.randomUUID();
+      const { error } = await client.schema(GR_SCHEMA).from(GR_REPEATER_TABLE).insert({
+        site_id: siteId,
+        repeater_id: repeaterId,
+        item_id: itemId,
+        slug: options?.slug ?? null,
+        sort_order: nextOrder
+      });
+      if (error) {
+        const message = error.code === "23505" ? "That slug is already used by another item." : error.message;
+        return { success: false, error: message };
+      }
+      return {
+        success: true,
+        item: { id: itemId, order: nextOrder, ...options?.slug ? { slug: options.slug } : {} }
+      };
+    },
+    async removeItem(repeaterId, siteId, itemId) {
+      const client = await sessionClient(creds);
+      const { error } = await client.schema(GR_SCHEMA).from(GR_REPEATER_TABLE).delete().eq("site_id", siteId).eq("repeater_id", repeaterId).eq("item_id", itemId);
+      return error ? { success: false, error: error.message } : { success: true };
+    },
+    async reorderItems(repeaterId, siteId, orderedItemIds) {
+      const client = await sessionClient(creds);
+      for (const [index, itemId] of orderedItemIds.entries()) {
+        const { error } = await client.schema(GR_SCHEMA).from(GR_REPEATER_TABLE).update({ sort_order: index }).eq("site_id", siteId).eq("repeater_id", repeaterId).eq("item_id", itemId);
+        if (error) return { success: false, error: error.message };
+      }
+      return { success: true };
+    }
+  };
+}
+export {
+  supabaseRepeaters
+};
+//# sourceMappingURL=repeaters.js.map

package/dist/adapters/supabase/repeaters.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/supabase/repeaters.ts"],"sourcesContent":["import { anonClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport { GR_REPEATER_TABLE, GR_SCHEMA } from \"../../core/defs\";\nimport type { GRRepeaterAdapter } from \"../../core/adapter-types\";\nimport type { GRRepeaterItem } from \"../../core/types\";\n\ninterface ItemRow {\n  item_id: string;\n  slug: string | null;\n  sort_order: number;\n}\n\nfunction toItem(row: ItemRow): GRRepeaterItem {\n  return {\n    id: row.item_id,\n    order: row.sort_order,\n    ...(row.slug ? { slug: row.slug } : {}),\n  };\n}\n\nconst SLUG = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n\nexport function supabaseRepeaters(creds: SupabaseCredentials): GRRepeaterAdapter {\n  assertCredentials(creds);\n\n  return {\n    async listItems(repeaterId, siteId) {\n      // Anon client: enumerating items is a public read, same as content.\n      const { data, error } = await anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_REPEATER_TABLE)\n        .select(\"item_id, slug, sort_order\")\n        .eq(\"site_id\", siteId)\n        .eq(\"repeater_id\", repeaterId)\n        .order(\"sort_order\", { ascending: true });\n\n      if (error) {\n        console.error(\"Guardrail (Supabase): list repeater items failed\", error.message);\n        return [];\n      }\n      return ((data ?? []) as ItemRow[]).map(toItem);\n    },\n\n    async getItemBySlug(repeaterId, siteId, slug) {\n      const { data, error } = await anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_REPEATER_TABLE)\n        .select(\"item_id, slug, sort_order\")\n        .eq(\"site_id\", siteId)\n        .eq(\"repeater_id\", repeaterId)\n        .eq(\"slug\", slug)\n        .maybeSingle();\n\n      if (error) {\n        console.error(\"Guardrail (Supabase): repeater item lookup failed\", error.message);\n        return null;\n      }\n      return data ? toItem(data as ItemRow) : null;\n    },\n\n    async addItem(repeaterId, siteId, options) {\n      if (options?.slug && !SLUG.test(options.slug)) {\n        return { success: false, error: \"Invalid slug.\" };\n      }\n\n      const client = await sessionClient(creds);\n      const table = client.schema(GR_SCHEMA).from(GR_REPEATER_TABLE);\n\n      // Two round trips (read max, then insert) rather than one atomic step.\n      // A race between two admins adding at the same instant could produce a\n      // duplicate sort_order — cosmetic (a reorder fixes it), not a\n      // correctness issue, and not worth a database function for how rarely\n      // two people edit the same repeater at once.\n      const { data: maxRow } = await table\n        .select(\"sort_order\")\n        .eq(\"site_id\", siteId)\n        .eq(\"repeater_id\", repeaterId)\n        .order(\"sort_order\", { ascending: false })\n        .limit(1)\n        .maybeSingle();\n\n      const nextOrder = (maxRow?.sort_order ?? -1) + 1;\n      const itemId = crypto.randomUUID();\n\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_REPEATER_TABLE)\n        .insert({\n          site_id: siteId,\n          repeater_id: repeaterId,\n          item_id: itemId,\n          slug: options?.slug ?? null,\n          sort_order: nextOrder,\n        });\n\n      if (error) {\n        // 23505: unique_violation — the partial index on (site_id, repeater_id, slug).\n        const message =\n          error.code === \"23505\"\n            ? \"That slug is already used by another item.\"\n            : error.message;\n        return { success: false, error: message };\n      }\n\n      return {\n        success: true,\n        item: { id: itemId, order: nextOrder, ...(options?.slug ? { slug: options.slug } : {}) },\n      };\n    },\n\n    async removeItem(repeaterId, siteId, itemId) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_REPEATER_TABLE)\n        .delete()\n        .eq(\"site_id\", siteId)\n        .eq(\"repeater_id\", repeaterId)\n        .eq(\"item_id\", itemId);\n      return error ? { success: false, error: error.message } : { success: true };\n    },\n\n    async reorderItems(repeaterId, siteId, orderedItemIds) {\n      const client = await sessionClient(creds);\n\n      // One update per item. Repeaters are meant to stay small (cards on a\n      // page, not a product catalog), so N small writes is the simple choice\n      // over a single upsert-by-array RPC.\n      for (const [index, itemId] of orderedItemIds.entries()) {\n        const { error } = await client\n          .schema(GR_SCHEMA)\n          .from(GR_REPEATER_TABLE)\n          .update({ sort_order: index })\n          .eq(\"site_id\", siteId)\n          .eq(\"repeater_id\", repeaterId)\n          .eq(\"item_id\", itemId);\n        if (error) return { success: false, error: error.message };\n      }\n      return { success: true };\n    },\n  };\n}\n"],"mappings":"AAAA,SAAS,YAAY,mBAAmB,qBAAqB;AAE7D,SAAS,mBAAmB,iBAAiB;AAU7C,SAAS,OAAO,KAA8B;AAC5C,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,OAAO,IAAI;AAAA,IACX,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;AAAA,EACvC;AACF;AAEA,MAAM,OAAO;AAEN,SAAS,kBAAkB,OAA+C;AAC/E,oBAAkB,KAAK;AAEvB,SAAO;AAAA,IACL,MAAM,UAAU,YAAY,QAAQ;AAElC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,WAAW,KAAK,EAC3C,OAAO,SAAS,EAChB,KAAK,iBAAiB,EACtB,OAAO,2BAA2B,EAClC,GAAG,WAAW,MAAM,EACpB,GAAG,eAAe,UAAU,EAC5B,MAAM,cAAc,EAAE,WAAW,KAAK,CAAC;AAE1C,UAAI,OAAO;AACT,gBAAQ,MAAM,oDAAoD,MAAM,OAAO;AAC/E,eAAO,CAAC;AAAA,MACV;AACA,cAAS,QAAQ,CAAC,GAAiB,IAAI,MAAM;AAAA,IAC/C;AAAA,IAEA,MAAM,cAAc,YAAY,QAAQ,MAAM;AAC5C,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,WAAW,KAAK,EAC3C,OAAO,SAAS,EAChB,KAAK,iBAAiB,EACtB,OAAO,2BAA2B,EAClC,GAAG,WAAW,MAAM,EACpB,GAAG,eAAe,UAAU,EAC5B,GAAG,QAAQ,IAAI,EACf,YAAY;AAEf,UAAI,OAAO;AACT,gBAAQ,MAAM,qDAAqD,MAAM,OAAO;AAChF,eAAO;AAAA,MACT;AACA,aAAO,OAAO,OAAO,IAAe,IAAI;AAAA,IAC1C;AAAA,IAEA,MAAM,QAAQ,YAAY,QAAQ,SAAS;AACzC,UAAI,SAAS,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG;AAC7C,eAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,MAClD;AAEA,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,QAAQ,OAAO,OAAO,SAAS,EAAE,KAAK,iBAAiB;AAO7D,YAAM,EAAE,MAAM,OAAO,IAAI,MAAM,MAC5B,OAAO,YAAY,EACnB,GAAG,WAAW,MAAM,EACpB,GAAG,eAAe,UAAU,EAC5B,MAAM,cAAc,EAAE,WAAW,MAAM,CAAC,EACxC,MAAM,CAAC,EACP,YAAY;AAEf,YAAM,aAAa,QAAQ,cAAc,MAAM;AAC/C,YAAM,SAAS,OAAO,WAAW;AAEjC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,iBAAiB,EACtB,OAAO;AAAA,QACN,SAAS;AAAA,QACT,aAAa;AAAA,QACb,SAAS;AAAA,QACT,MAAM,SAAS,QAAQ;AAAA,QACvB,YAAY;AAAA,MACd,CAAC;AAEH,UAAI,OAAO;AAET,cAAM,UACJ,MAAM,SAAS,UACX,+CACA,MAAM;AACZ,eAAO,EAAE,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM,EAAE,IAAI,QAAQ,OAAO,WAAW,GAAI,SAAS,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC,EAAG;AAAA,MACzF;AAAA,IACF;AAAA,IAEA,MAAM,WAAW,YAAY,QAAQ,QAAQ;AAC3C,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,iBAAiB,EACtB,OAAO,EACP,GAAG,WAAW,MAAM,EACpB,GAAG,eAAe,UAAU,EAC5B,GAAG,WAAW,MAAM;AACvB,aAAO,QAAQ,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IAAI,EAAE,SAAS,KAAK;AAAA,IAC5E;AAAA,IAEA,MAAM,aAAa,YAAY,QAAQ,gBAAgB;AACrD,YAAM,SAAS,MAAM,cAAc,KAAK;AAKxC,iBAAW,CAAC,OAAO,MAAM,KAAK,eAAe,QAAQ,GAAG;AACtD,cAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,iBAAiB,EACtB,OAAO,EAAE,YAAY,MAAM,CAAC,EAC5B,GAAG,WAAW,MAAM,EACpB,GAAG,eAAe,UAAU,EAC5B,GAAG,WAAW,MAAM;AACvB,YAAI,MAAO,QAAO,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ;AAAA,MAC3D;AACA,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}

package/dist/adapters/supabase/storage.d.ts

@@ -0,0 +1,18 @@
+import { SupabaseCredentials } from './client.js';
+import { GRStorageAdapter } from '../../core/adapter-types.js';
+import '@supabase/supabase-js';
+import 'react';
+import '../../core/types.js';
+
+declare const DEFAULT_BUCKET = "gr-media";
+interface SupabaseStorageOptions extends SupabaseCredentials {
+    /**
+     * Bucket to store media in. Defaults to `gr-media`. Any name starting with
+     * `gr-` works: the init migration scopes its storage policies to that prefix, and a
+     * missing bucket is created on the first upload.
+     */
+    bucket?: string;
+}
+declare function supabaseStorage(options: SupabaseStorageOptions): GRStorageAdapter;
+
+export { DEFAULT_BUCKET, type SupabaseStorageOptions, supabaseStorage };

package/dist/adapters/supabase/storage.js

@@ -0,0 +1,93 @@
+import { assertCredentials, sessionClient } from "./client";
+import { GR_SCHEMA } from "../../core/defs";
+const DEFAULT_BUCKET = "gr-media";
+function safeName(name) {
+  const dot = name.lastIndexOf(".");
+  const base = (dot > 0 ? name.slice(0, dot) : name).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
+  const ext = dot > 0 ? name.slice(dot + 1).toLowerCase().replace(/[^a-z0-9]/g, "") : "";
+  return ext ? `${base}.${ext}` : base;
+}
+const BUCKET_NAME = /^gr-[a-z0-9][a-z0-9-]{0,50}$/;
+const UUID_PREFIX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}-/;
+function supabaseStorage(options) {
+  assertCredentials(options);
+  const creds = { url: options.url, anonKey: options.anonKey };
+  const bucket = options.bucket || DEFAULT_BUCKET;
+  if (!BUCKET_NAME.test(bucket)) {
+    throw new Error(
+      `Guardrail (Supabase): bucket "${bucket}" must start with "gr-" and use lowercase letters, numbers, and hyphens \u2014 the init migration scopes storage policies to that prefix.`
+    );
+  }
+  let ensured = null;
+  async function ensureBucket(client) {
+    ensured ??= (async () => {
+      const { error } = await client.schema(GR_SCHEMA).rpc("gr_ensure_bucket", {
+        target_bucket: bucket
+      });
+      if (error) throw new Error(`could not ensure bucket "${bucket}" \u2014 ${error.message}`);
+    })();
+    try {
+      await ensured;
+    } catch (e) {
+      ensured = null;
+      throw e;
+    }
+  }
+  return {
+    async createUpload(siteId, file) {
+      const path = `${siteId}/${crypto.randomUUID()}-${safeName(file.name)}`;
+      const client = await sessionClient(creds);
+      await ensureBucket(client);
+      const storage = client.storage.from(bucket);
+      const { data, error } = await storage.createSignedUploadUrl(path);
+      if (error || !data) {
+        throw new Error(
+          `Guardrail (Supabase): could not create upload in "${bucket}" \u2014 ${error?.message ?? "no data"}`
+        );
+      }
+      return {
+        url: data.signedUrl,
+        method: "PUT",
+        headers: {
+          "content-type": file.contentType,
+          // Names are unique per upload, so the object never changes in place.
+          "cache-control": "max-age=31536000"
+        },
+        asset: {
+          id: path,
+          url: storage.getPublicUrl(path).data.publicUrl,
+          name: file.name,
+          size: file.size,
+          contentType: file.contentType
+        }
+      };
+    },
+    async listAssets(siteId, { limit = 100 } = {}) {
+      const storage = (await sessionClient(creds)).storage.from(bucket);
+      const { data, error } = await storage.list(siteId, {
+        limit,
+        sortBy: { column: "created_at", order: "desc" }
+      });
+      if (error) {
+        console.error("Guardrail (Supabase): list assets failed", error.message);
+        return [];
+      }
+      return (data ?? []).filter((f) => f.id && !f.name.startsWith(".")).map((f) => {
+        const path = `${siteId}/${f.name}`;
+        return {
+          id: path,
+          url: storage.getPublicUrl(path).data.publicUrl,
+          name: f.name.replace(UUID_PREFIX, ""),
+          size: f.metadata?.size,
+          contentType: f.metadata?.mimetype,
+          createdAt: f.created_at
+        };
+      });
+    }
+  };
+}
+export {
+  DEFAULT_BUCKET,
+  supabaseStorage
+};
+//# sourceMappingURL=storage.js.map

package/dist/adapters/supabase/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/supabase/storage.ts"],"sourcesContent":["import type { SupabaseClient } from \"@supabase/supabase-js\";\nimport { assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport type { GRStorageAdapter } from \"../../core/adapter-types\";\nimport type { GRAsset } from \"../../core/types\";\nimport { GR_SCHEMA } from \"../../core/defs\";\n\nexport const DEFAULT_BUCKET = \"gr-media\";\n\nexport interface SupabaseStorageOptions extends SupabaseCredentials {\n  /**\n   * Bucket to store media in. Defaults to `gr-media`. Any name starting with\n   * `gr-` works: the init migration scopes its storage policies to that prefix, and a\n   * missing bucket is created on the first upload.\n   */\n  bucket?: string;\n}\n\n/** URL- and filesystem-safe object names that still read as the original file. */\nfunction safeName(name: string): string {\n  const dot = name.lastIndexOf(\".\");\n  const base =\n    (dot > 0 ? name.slice(0, dot) : name)\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\")\n      .slice(0, 60) || \"file\";\n  const ext =\n    dot > 0 ? name.slice(dot + 1).toLowerCase().replace(/[^a-z0-9]/g, \"\") : \"\";\n  return ext ? `${base}.${ext}` : base;\n}\n\n/** Mirrors the check in gr_ensure_bucket(). */\nconst BUCKET_NAME = /^gr-[a-z0-9][a-z0-9-]{0,50}$/;\n\nconst UUID_PREFIX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}-/;\n\nexport function supabaseStorage(options: SupabaseStorageOptions): GRStorageAdapter {\n  assertCredentials(options);\n  const creds = { url: options.url, anonKey: options.anonKey };\n  const bucket = options.bucket || DEFAULT_BUCKET;\n\n  // Fail at startup with a clear message rather than at upload time with an\n  // opaque RLS denial.\n  if (!BUCKET_NAME.test(bucket)) {\n    throw new Error(\n      `Guardrail (Supabase): bucket \"${bucket}\" must start with \"gr-\" and use ` +\n        \"lowercase letters, numbers, and hyphens — the init migration scopes storage \" +\n        \"policies to that prefix.\",\n    );\n  }\n\n  /**\n   * Created at most once per server process, and only on upload — browsing a\n   * library that does not exist yet just shows it empty. A failure is not\n   * cached, so the next upload retries.\n   */\n  let ensured: Promise<void> | null = null;\n  async function ensureBucket(client: SupabaseClient): Promise<void> {\n    ensured ??= (async () => {\n      const { error } = await client.schema(GR_SCHEMA).rpc(\"gr_ensure_bucket\", {\n        target_bucket: bucket,\n      });\n      if (error) throw new Error(`could not ensure bucket \"${bucket}\" — ${error.message}`);\n    })();\n    try {\n      await ensured;\n    } catch (e) {\n      ensured = null;\n      throw e;\n    }\n  }\n\n  return {\n    async createUpload(siteId, file) {\n      // Namespaced by site: the storage RLS policies key off this first folder.\n      const path = `${siteId}/${crypto.randomUUID()}-${safeName(file.name)}`;\n      // Session client, so the signed URL is only issued if RLS lets this\n      // editor insert into the site's folder.\n      const client = await sessionClient(creds);\n      await ensureBucket(client);\n      const storage = client.storage.from(bucket);\n\n      const { data, error } = await storage.createSignedUploadUrl(path);\n      if (error || !data) {\n        throw new Error(\n          `Guardrail (Supabase): could not create upload in \"${bucket}\" — ${error?.message ?? \"no data\"}`,\n        );\n      }\n\n      return {\n        url: data.signedUrl,\n        method: \"PUT\",\n        headers: {\n          \"content-type\": file.contentType,\n          // Names are unique per upload, so the object never changes in place.\n          \"cache-control\": \"max-age=31536000\",\n        },\n        asset: {\n          id: path,\n          url: storage.getPublicUrl(path).data.publicUrl,\n          name: file.name,\n          size: file.size,\n          contentType: file.contentType,\n        },\n      };\n    },\n\n    async listAssets(siteId, { limit = 100 } = {}) {\n      const storage = (await sessionClient(creds)).storage.from(bucket);\n      const { data, error } = await storage.list(siteId, {\n        limit,\n        sortBy: { column: \"created_at\", order: \"desc\" },\n      });\n      if (error) {\n        console.error(\"Guardrail (Supabase): list assets failed\", error.message);\n        return [];\n      }\n\n      return (data ?? [])\n        // Folders have no id, and Supabase drops a dotfile placeholder into empty ones.\n        .filter((f) => f.id && !f.name.startsWith(\".\"))\n        .map((f): GRAsset => {\n          const path = `${siteId}/${f.name}`;\n          return {\n            id: path,\n            url: storage.getPublicUrl(path).data.publicUrl,\n            name: f.name.replace(UUID_PREFIX, \"\"),\n            size: f.metadata?.size,\n            contentType: f.metadata?.mimetype,\n            createdAt: f.created_at,\n          };\n        });\n    },\n  };\n}\n"],"mappings":"AACA,SAAS,mBAAmB,qBAAqB;AAIjD,SAAS,iBAAiB;AAEnB,MAAM,iBAAiB;AAY9B,SAAS,SAAS,MAAsB;AACtC,QAAM,MAAM,KAAK,YAAY,GAAG;AAChC,QAAM,QACH,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,IAAI,MAC7B,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,EAAE,KAAK;AACrB,QAAM,MACJ,MAAM,IAAI,KAAK,MAAM,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,cAAc,EAAE,IAAI;AAC1E,SAAO,MAAM,GAAG,IAAI,IAAI,GAAG,KAAK;AAClC;AAGA,MAAM,cAAc;AAEpB,MAAM,cAAc;AAEb,SAAS,gBAAgB,SAAmD;AACjF,oBAAkB,OAAO;AACzB,QAAM,QAAQ,EAAE,KAAK,QAAQ,KAAK,SAAS,QAAQ,QAAQ;AAC3D,QAAM,SAAS,QAAQ,UAAU;AAIjC,MAAI,CAAC,YAAY,KAAK,MAAM,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR,iCAAiC,MAAM;AAAA,IAGzC;AAAA,EACF;AAOA,MAAI,UAAgC;AACpC,iBAAe,aAAa,QAAuC;AACjE,iBAAa,YAAY;AACvB,YAAM,EAAE,MAAM,IAAI,MAAM,OAAO,OAAO,SAAS,EAAE,IAAI,oBAAoB;AAAA,QACvE,eAAe;AAAA,MACjB,CAAC;AACD,UAAI,MAAO,OAAM,IAAI,MAAM,4BAA4B,MAAM,YAAO,MAAM,OAAO,EAAE;AAAA,IACrF,GAAG;AACH,QAAI;AACF,YAAM;AAAA,IACR,SAAS,GAAG;AACV,gBAAU;AACV,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,aAAa,QAAQ,MAAM;AAE/B,YAAM,OAAO,GAAG,MAAM,IAAI,OAAO,WAAW,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC;AAGpE,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,aAAa,MAAM;AACzB,YAAM,UAAU,OAAO,QAAQ,KAAK,MAAM;AAE1C,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAAQ,sBAAsB,IAAI;AAChE,UAAI,SAAS,CAAC,MAAM;AAClB,cAAM,IAAI;AAAA,UACR,qDAAqD,MAAM,YAAO,OAAO,WAAW,SAAS;AAAA,QAC/F;AAAA,MACF;AAEA,aAAO;AAAA,QACL,KAAK,KAAK;AAAA,QACV,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB,KAAK;AAAA;AAAA,UAErB,iBAAiB;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,IAAI;AAAA,UACJ,KAAK,QAAQ,aAAa,IAAI,EAAE,KAAK;AAAA,UACrC,MAAM,KAAK;AAAA,UACX,MAAM,KAAK;AAAA,UACX,aAAa,KAAK;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,WAAW,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,GAAG;AAC7C,YAAM,WAAW,MAAM,cAAc,KAAK,GAAG,QAAQ,KAAK,MAAM;AAChE,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,QAAQ,KAAK,QAAQ;AAAA,QACjD;AAAA,QACA,QAAQ,EAAE,QAAQ,cAAc,OAAO,OAAO;AAAA,MAChD,CAAC;AACD,UAAI,OAAO;AACT,gBAAQ,MAAM,4CAA4C,MAAM,OAAO;AACvE,eAAO,CAAC;AAAA,MACV;AAEA,cAAQ,QAAQ,CAAC,GAEd,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,WAAW,GAAG,CAAC,EAC7C,IAAI,CAAC,MAAe;AACnB,cAAM,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI;AAChC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,KAAK,QAAQ,aAAa,IAAI,EAAE,KAAK;AAAA,UACrC,MAAM,EAAE,KAAK,QAAQ,aAAa,EAAE;AAAA,UACpC,MAAM,EAAE,UAAU;AAAA,UAClB,aAAa,EAAE,UAAU;AAAA,UACzB,WAAW,EAAE;AAAA,QACf;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AACF;","names":[]}

package/dist/core/adapter-types.d.ts

@@ -0,0 +1,212 @@
+import { ReactNode } from 'react';
+import { OverrideRow, GRMember, GRRole, GRAsset, GRRepeaterItem } from './types.js';
+
+interface GRStorageRow {
+    pathKey: string;
+    siteId: string;
+    type: string;
+    value: unknown;
+}
+interface GRDBAdapter {
+    /**
+     * Resolve many keys in one round trip.
+     *
+     * Batched rather than single-key because a page has one <GRail> per field;
+     * a per-key interface makes a 30-field page issue 30 queries. Keys are
+     * pre-deduplicated. Missing keys are simply absent from the result — order
+     * is not significant.
+     */
+    getOverrides: (pathKeys: string[], siteId: string) => Promise<OverrideRow[]>;
+    setOverride: (row: GRStorageRow) => Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    /**
+     * Bulk-remove every override whose pathKey starts with this prefix.
+     *
+     * Optional, and called only when a repeater item is deleted — its fields
+     * (`${repeaterId}.${itemId}.*`) would otherwise become unreachable orphans.
+     * An adapter that cannot do this cheaply may omit it; the item's manifest
+     * row is still removed, just not its old field values.
+     */
+    deleteOverrides?: (pathKeyPrefix: string, siteId: string) => Promise<void>;
+}
+/** Identity of a signed-in editor, as verified by the auth adapter. */
+interface GRSession {
+    userId: string;
+    email?: string;
+}
+interface GRAuthAdapter {
+    /**
+     * Verify an email/password pair and establish a provider session.
+     *
+     * Optional: password auth is one mechanism among several. Providers built
+     * around magic links, SSO, or a hosted sign-in page omit this and set
+     * `signInUrl` instead, and Guardrail then hands sign-in off rather than
+     * rendering a form it cannot fulfil.
+     */
+    authenticate?: (email: string, password: string) => Promise<AuthResult>;
+    /**
+     * Where to send someone who needs to sign in, when this adapter does not
+     * accept passwords directly. Guardrail links to it instead of showing a form.
+     */
+    signInUrl?: string;
+    /**
+     * Ask the provider to create an account for an invited address and contact
+     * them. Optional — Guardrail falls back to the onInvite callback when the
+     * provider cannot do it.
+     *
+     * Account creation stays the identity provider's job. Guardrail records who
+     * is allowed to edit; it never owns credentials.
+     */
+    inviteUser?: (email: string, options?: {
+        redirectTo?: string;
+    }) => Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    /**
+     * Return the current verified session, or null.
+     *
+     * This is the sole authorization check for writes, so it MUST validate the
+     * session against the provider rather than trusting a cookie's presence.
+     */
+    getSession: () => Promise<GRSession | null>;
+    logout: () => Promise<void>;
+}
+type AuthResult = {
+    success: true;
+    session: GRSession;
+} | {
+    success: false;
+    error: string;
+};
+/**
+ * Membership is Guardrail's own data, deliberately not the auth provider's.
+ * Keeping it separate means the identity vendor and the storage vendor never
+ * have to be the same one — the auth adapter only has to name the user.
+ */
+interface GRMembershipAdapter {
+    getMember: (siteId: string, lookup: {
+        userId?: string;
+        email?: string;
+    }) => Promise<GRMember | null>;
+    listMembers: (siteId: string) => Promise<GRMember[]>;
+    upsertMember: (siteId: string, member: {
+        email: string;
+        role: GRRole;
+        userId?: string | null;
+        status: "active" | "pending";
+    }) => Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    removeMember: (siteId: string, email: string) => Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    /**
+     * Bind a pending invitation to the signed-in user.
+     *
+     * Separate from upsertMember because claiming must not be able to change the
+     * role it was invited with. Implementations must enforce that server-side —
+     * an RLS policy permissive enough to let someone write their own row is
+     * permissive enough to let them write themselves in as an admin.
+     */
+    claimInvite: (siteId: string) => Promise<void>;
+}
+/** Where and how the browser sends a file's bytes. */
+interface GRUploadTarget {
+    url: string;
+    method: "PUT" | "POST";
+    headers?: Record<string, string>;
+    /** The asset as it will exist once the upload completes. */
+    asset: GRAsset;
+}
+/**
+ * File storage, deliberately separate from the database adapter so content and
+ * media can live with different providers — Supabase for content, UploadThing
+ * or S3 for images.
+ *
+ * Bytes never pass through the Next.js server: createUpload returns a signed
+ * target and the browser uploads straight to it. Server actions cap request
+ * bodies at around 1MB, which a single photo exceeds.
+ */
+interface GRStorageAdapter {
+    createUpload: (siteId: string, file: {
+        name: string;
+        contentType: string;
+        size: number;
+    }) => Promise<GRUploadTarget>;
+    listAssets: (siteId: string, options?: {
+        limit?: number;
+    }) => Promise<GRAsset[]>;
+}
+/**
+ * Ordered instances of one developer-authored template component — the
+ * repeater's manifest. Deliberately not a content model: it tracks identity
+ * and order only. The shape of an item lives entirely in the developer's JSX,
+ * exactly like any other Guardrail field, so there is no schema to define, no
+ * field-type registry, and no per-repeater configuration beyond this.
+ *
+ * A separate slot from GRDBAdapter, mirroring storage, so the manifest can
+ * live with a different backend than content if that is ever useful — though
+ * unlike storage, an item's own fields always resolve through the configured
+ * `db` adapter, using the same pathKey convention as everything else.
+ */
+interface GRRepeaterAdapter {
+    listItems: (repeaterId: string, siteId: string) => Promise<GRRepeaterItem[]>;
+    getItemBySlug: (repeaterId: string, siteId: string, slug: string) => Promise<GRRepeaterItem | null>;
+    addItem: (repeaterId: string, siteId: string, options?: {
+        slug?: string;
+    }) => Promise<{
+        success: true;
+        item: GRRepeaterItem;
+    } | {
+        success: false;
+        error: string;
+    }>;
+    removeItem: (repeaterId: string, siteId: string, itemId: string) => Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    /** Full replacement of order, since a reorder always touches every item. */
+    reorderItems: (repeaterId: string, siteId: string, orderedItemIds: string[]) => Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+}
+interface GRInviteEvent {
+    email: string;
+    role: GRRole;
+    siteId: string;
+    invitedBy: string;
+}
+interface GRConfig {
+    db: GRDBAdapter;
+    auth: GRAuthAdapter;
+    members: GRMembershipAdapter;
+    /** Optional — only needed when images are editable. */
+    storage?: GRStorageAdapter;
+    /** Optional — only needed when a page uses <GRepeater>. */
+    repeaters?: GRRepeaterAdapter;
+    siteId: string | (() => string | Promise<string>);
+    /**
+     * Called when an admin invites someone. Guardrail records the pending
+     * membership; delivering the invitation is the app's job, using whatever
+     * mail provider it already has. In-process by design — a library running
+     * inside the developer's server has no need for webhooks.
+     */
+    onInvite?: (event: GRInviteEvent) => void | Promise<void>;
+    /**
+     * Extra content rendered in the toolbar pill, next to Team and Log out.
+     * Plain JSX, not a component reference or a structured item schema — the
+     * same "expose the primitive, developer owns the styling" rule as
+     * everything else in this library. Render it in a Server Component (a
+     * layout, typically) so it crosses into the toolbar's Client Component as
+     * an already-resolved element, not a function.
+     */
+    toolbarExtra?: ReactNode;
+}
+
+export type { AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget };

package/dist/core/adapter-types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=adapter-types.js.map

package/dist/core/adapter-types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/core/bailout.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Next.js and React signal "this render must go dynamic" by throwing. Those
+ * throws are control flow, not failures — swallowing one makes a route silently
+ * render with missing data instead of bailing out to dynamic rendering.
+ * Every catch around framework-touching code has to let them through.
+ */
+declare function rethrowIfBailout(error: unknown): void;
+
+export { rethrowIfBailout };

package/dist/core/bailout.js

@@ -0,0 +1,14 @@
+function rethrowIfBailout(error) {
+  if (typeof error !== "object" || error === null) return;
+  const digest = error.digest;
+  if (typeof digest === "string" && (digest === "DYNAMIC_SERVER_USAGE" || digest === "NEXT_NOT_FOUND" || digest === "NEXT_REDIRECT" || digest.startsWith("BAILOUT_TO_CLIENT_SIDE_RENDERING"))) {
+    throw error;
+  }
+  if (error.$$typeof === /* @__PURE__ */ Symbol.for("react.postpone")) {
+    throw error;
+  }
+}
+export {
+  rethrowIfBailout
+};
+//# sourceMappingURL=bailout.js.map

package/dist/core/bailout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/bailout.ts"],"sourcesContent":["/**\n * Next.js and React signal \"this render must go dynamic\" by throwing. Those\n * throws are control flow, not failures — swallowing one makes a route silently\n * render with missing data instead of bailing out to dynamic rendering.\n * Every catch around framework-touching code has to let them through.\n */\nexport function rethrowIfBailout(error: unknown): void {\n  if (typeof error !== \"object\" || error === null) return;\n\n  const digest = (error as { digest?: unknown }).digest;\n  if (\n    typeof digest === \"string\" &&\n    (digest === \"DYNAMIC_SERVER_USAGE\" ||\n      digest === \"NEXT_NOT_FOUND\" ||\n      digest === \"NEXT_REDIRECT\" ||\n      digest.startsWith(\"BAILOUT_TO_CLIENT_SIDE_RENDERING\"))\n  ) {\n    throw error;\n  }\n\n  // React's PPR postpone signal.\n  if ((error as { $$typeof?: symbol }).$$typeof === Symbol.for(\"react.postpone\")) {\n    throw error;\n  }\n}\n"],"mappings":"AAMO,SAAS,iBAAiB,OAAsB;AACrD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM;AAEjD,QAAM,SAAU,MAA+B;AAC/C,MACE,OAAO,WAAW,aACjB,WAAW,0BACV,WAAW,oBACX,WAAW,mBACX,OAAO,WAAW,kCAAkC,IACtD;AACA,UAAM;AAAA,EACR;AAGA,MAAK,MAAgC,aAAa,uBAAO,IAAI,gBAAgB,GAAG;AAC9E,UAAM;AAAA,EACR;AACF;","names":[]}

package/dist/core/config.d.ts

@@ -0,0 +1,27 @@
+import { GRConfig, GRAuthAdapter, GRDBAdapter, GRMembershipAdapter, GRRepeaterAdapter, GRStorageAdapter } from './adapter-types.js';
+import 'react';
+import './types.js';
+
+/**
+ * Registers the adapters Guardrail should use.
+ *
+ * Idempotent, and re-applied on every render by withGuardrail: Next.js does not
+ * guarantee one shared module instance across the SSR graph, the server-action
+ * graph, and the workers used for static generation, so config registered once
+ * at startup is simply absent in some of them.
+ *
+ * Core has no knowledge of any particular backend — there is no default and no
+ * fallback. An app names its adapters explicitly or Guardrail refuses to run.
+ */
+declare function configureGuardrail(config: GRConfig): void;
+declare function getDB(): GRDBAdapter;
+declare function getAuth(): GRAuthAdapter;
+declare function getMembers(): GRMembershipAdapter;
+/** Optional — sites without editable images need no storage. */
+declare function getStorage(): GRStorageAdapter | undefined;
+/** Throws with a clear message if no page on this site uses <GRepeater>. */
+declare function getRepeaters(): GRRepeaterAdapter;
+declare function getInviteHandler(): GRConfig["onInvite"];
+declare function resolveSiteId(): Promise<string>;
+
+export { configureGuardrail, getAuth, getDB, getInviteHandler, getMembers, getRepeaters, getStorage, resolveSiteId };