@guard-rail/core 0.1.0

package/dist/server/actions.js

@@ -0,0 +1,214 @@
+"use server";
+import { revalidatePath } from "next/cache";
+import { headers } from "next/headers";
+import {
+  getAuth,
+  getDB,
+  getInviteHandler,
+  getMembers,
+  getStorage,
+  resolveSiteId
+} from "../core/config";
+import { getCachedViewer } from "./session";
+import { rethrowIfBailout } from "../core/bailout";
+const DENIED = { success: false, error: "Unauthorized." };
+async function requireRole(allowed) {
+  const viewer = await getCachedViewer();
+  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;
+  return viewer;
+}
+async function saveOverride(row) {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return DENIED;
+  const rowToSend = {
+    pathKey: row.pathKey,
+    siteId: await resolveSiteId(),
+    type: row.value.type,
+    value: row.value
+  };
+  try {
+    const db = getDB();
+    const res = await db.setOverride(rowToSend);
+    if (!res.success) return res;
+    revalidatePath("/", "layout");
+    return { success: true };
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: save failed", e);
+    return { success: false, error: "Database write failed." };
+  }
+}
+const IMAGE_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif", "image/avif"];
+const MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+async function createAssetUpload(file) {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return { success: false, error: "Unauthorized." };
+  const storage = getStorage();
+  if (!storage) {
+    return { success: false, error: "No storage adapter is configured." };
+  }
+  if (!IMAGE_TYPES.includes(file.contentType)) {
+    return { success: false, error: "Upload a PNG, JPEG, WebP, GIF, or AVIF image." };
+  }
+  if (!(file.size > 0) || file.size > MAX_UPLOAD_BYTES) {
+    return { success: false, error: "Images must be under 10 MB." };
+  }
+  try {
+    const target = await storage.createUpload(await resolveSiteId(), file);
+    return { success: true, target };
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: createUpload failed", e);
+    const detail = process.env.NODE_ENV !== "production" && e instanceof Error ? ` ${e.message}` : "";
+    return { success: false, error: `Could not start the upload.${detail}` };
+  }
+}
+async function listAssets() {
+  const viewer = await requireRole(["admin", "editor"]);
+  const storage = getStorage();
+  if (!viewer || !storage) return [];
+  return storage.listAssets(await resolveSiteId());
+}
+async function listTeam() {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return [];
+  const members = getMembers();
+  return members.listMembers(await resolveSiteId());
+}
+async function inviteMember(email, role) {
+  const viewer = await requireRole(["admin"]);
+  if (!viewer) return DENIED;
+  const normalized = email.toLowerCase().trim();
+  if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(normalized)) {
+    return { success: false, error: "Enter a valid email address." };
+  }
+  const siteId = await resolveSiteId();
+  const members = getMembers();
+  const existing = await members.getMember(siteId, { email: normalized });
+  if (existing?.status === "active") {
+    return { success: false, error: "That address is already on the team." };
+  }
+  if (!existing) {
+    const res = await members.upsertMember(siteId, {
+      email: normalized,
+      role,
+      userId: null,
+      status: "pending"
+    });
+    if (!res.success) return res;
+  }
+  const auth = getAuth();
+  if (auth.inviteUser) {
+    const sent = await auth.inviteUser(normalized, {
+      redirectTo: `${await requestOrigin()}/?edit=true`
+    });
+    revalidatePath("/", "layout");
+    return sent.success ? { success: true } : {
+      success: false,
+      error: `Invite saved, but the email failed: ${sent.error}`
+    };
+  }
+  try {
+    await getInviteHandler()?.({
+      email: normalized,
+      role: existing?.role ?? role,
+      siteId,
+      invitedBy: viewer.email ?? viewer.userId
+    });
+  } catch (e) {
+    console.error("Guardrail: onInvite handler threw", e);
+  }
+  revalidatePath("/", "layout");
+  return { success: true };
+}
+async function updateMemberRole(email, role) {
+  const viewer = await requireRole(["admin"]);
+  if (!viewer) return DENIED;
+  const siteId = await resolveSiteId();
+  const members = getMembers();
+  const target = await members.getMember(siteId, {
+    email: email.toLowerCase().trim()
+  });
+  if (!target) return { success: false, error: "No such member." };
+  if (target.role === "admin" && role !== "admin") {
+    const guard = await wouldStrandSite(siteId, target.email);
+    if (guard) return guard;
+  }
+  const res = await members.upsertMember(siteId, {
+    email: target.email,
+    role,
+    userId: target.userId,
+    status: target.status
+  });
+  if (res.success) revalidatePath("/", "layout");
+  return res;
+}
+async function removeMember(email) {
+  const viewer = await requireRole(["admin"]);
+  if (!viewer) return DENIED;
+  const siteId = await resolveSiteId();
+  const members = getMembers();
+  const normalized = email.toLowerCase().trim();
+  const guard = await wouldStrandSite(siteId, normalized);
+  if (guard) return guard;
+  const res = await members.removeMember(siteId, normalized);
+  if (res.success) revalidatePath("/", "layout");
+  return res;
+}
+async function requestOrigin() {
+  const h = await headers();
+  const origin = h.get("origin");
+  if (origin) return origin;
+  const host = h.get("x-forwarded-host") ?? h.get("host") ?? "localhost";
+  const proto = h.get("x-forwarded-proto") ?? (host.startsWith("localhost") ? "http" : "https");
+  return `${proto}://${host}`;
+}
+async function wouldStrandSite(siteId, email) {
+  const members = getMembers();
+  const all = await members.listMembers(siteId);
+  const admins = all.filter((m) => m.role === "admin");
+  if (admins.length <= 1 && admins.some((m) => m.email === email)) {
+    return {
+      success: false,
+      error: "A site must keep at least one admin."
+    };
+  }
+  return null;
+}
+async function loginAction(_prev, formData) {
+  const email = String(formData.get("email") ?? "");
+  const password = String(formData.get("password") ?? "");
+  const auth = getAuth();
+  if (!auth.authenticate) {
+    return {
+      success: false,
+      error: "This site's auth provider does not accept passwords.",
+      email
+    };
+  }
+  const result = await auth.authenticate(email, password);
+  if (!result.success) {
+    return { success: false, error: result.error, email };
+  }
+  revalidatePath("/", "layout");
+  return { success: true, email };
+}
+async function logoutAction() {
+  const auth = getAuth();
+  await auth.logout();
+  revalidatePath("/", "layout");
+  return { success: true };
+}
+export {
+  createAssetUpload,
+  inviteMember,
+  listAssets,
+  listTeam,
+  loginAction,
+  logoutAction,
+  removeMember,
+  requireRole,
+  saveOverride,
+  updateMemberRole
+};
+//# sourceMappingURL=actions.js.map

package/dist/server/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/actions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { headers } from \"next/headers\";\nimport {\n  getAuth,\n  getDB,\n  getInviteHandler,\n  getMembers,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type {\n  ActionState,\n  GRAsset,\n  GRMember,\n  GRRole,\n  GRViewer,\n  OverrideRow,\n} from \"../core/types\";\nimport type { GRStorageRow, GRUploadTarget } from \"../core/adapter-types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\n/**\n * Every mutation re-resolves the viewer server-side. The client's copy of the\n * role decides what to *show*; it never decides what is *allowed*. A hidden\n * button is not authorization — this is the same lesson as the session cookie.\n */\nexport async function requireRole(\n  allowed: readonly GRRole[],\n): Promise<GRViewer | null> {\n  const viewer = await getCachedViewer();\n  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;\n  return viewer;\n}\n\nexport async function saveOverride(row: OverrideRow): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  const rowToSend: GRStorageRow = {\n    pathKey: row.pathKey,\n    siteId: await resolveSiteId(),\n    type: row.value.type,\n    value: row.value,\n  };\n\n  try {\n    const db = getDB();\n    const res = await db.setOverride(rowToSend);\n    if (!res.success) return res;\n\n    // TODO: too broad — purges every cached route on any single-field save.\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: save failed\", e);\n    return { success: false, error: \"Database write failed.\" };\n  }\n}\n\n/* --------------------------------------------------------------- media --- */\n\n// SVG is excluded on purpose: it can carry script, and next/image refuses it\n// by default anyway.\nconst IMAGE_TYPES = [\"image/png\", \"image/jpeg\", \"image/webp\", \"image/gif\", \"image/avif\"];\nconst MAX_UPLOAD_BYTES = 10 * 1024 * 1024;\n\n/**\n * Authorizes an upload and returns where the browser should send the bytes.\n * Only metadata comes through here — the file itself goes straight to storage.\n */\nexport async function createAssetUpload(file: {\n  name: string;\n  contentType: string;\n  size: number;\n}): Promise<\n  { success: true; target: GRUploadTarget } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  const storage = getStorage();\n  if (!storage) {\n    return { success: false, error: \"No storage adapter is configured.\" };\n  }\n  if (!IMAGE_TYPES.includes(file.contentType)) {\n    return { success: false, error: \"Upload a PNG, JPEG, WebP, GIF, or AVIF image.\" };\n  }\n  if (!(file.size > 0) || file.size > MAX_UPLOAD_BYTES) {\n    return { success: false, error: \"Images must be under 10 MB.\" };\n  }\n\n  try {\n    const target = await storage.createUpload(await resolveSiteId(), file);\n    return { success: true, target };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: createUpload failed\", e);\n    // Failures here are almost always setup (missing SQL, bucket, or policy),\n    // so show the cause while developing. Production keeps it generic rather\n    // than exposing backend detail to editors.\n    const detail =\n      process.env.NODE_ENV !== \"production\" && e instanceof Error\n        ? ` ${e.message}`\n        : \"\";\n    return { success: false, error: `Could not start the upload.${detail}` };\n  }\n}\n\nexport async function listAssets(): Promise<GRAsset[]> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  const storage = getStorage();\n  if (!viewer || !storage) return [];\n  return storage.listAssets(await resolveSiteId());\n}\n\n/* ---------------------------------------------------------------- team --- */\n\nexport async function listTeam(): Promise<GRMember[]> {\n  // Any member may see who else is on the site; only admins may change it.\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return [];\n\n  const members = getMembers();\n  return members.listMembers(await resolveSiteId());\n}\n\nexport async function inviteMember(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const normalized = email.toLowerCase().trim();\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(normalized)) {\n    return { success: false, error: \"Enter a valid email address.\" };\n  }\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const existing = await members.getMember(siteId, { email: normalized });\n  if (existing?.status === \"active\") {\n    return { success: false, error: \"That address is already on the team.\" };\n  }\n\n  // A pending invite is re-sent rather than rejected: provider email is\n  // rate-limited and unreliable enough that resending has to be possible.\n  if (!existing) {\n    const res = await members.upsertMember(siteId, {\n      email: normalized,\n      role,\n      userId: null,\n      status: \"pending\",\n    });\n    if (!res.success) return res;\n  }\n\n  const auth = getAuth();\n  if (auth.inviteUser) {\n    // The membership is already written; a failed send must not undo it.\n    const sent = await auth.inviteUser(normalized, {\n      redirectTo: `${await requestOrigin()}/?edit=true`,\n    });\n    revalidatePath(\"/\", \"layout\");\n    return sent.success\n      ? { success: true }\n      : {\n          success: false,\n          error: `Invite saved, but the email failed: ${sent.error}`,\n        };\n  }\n\n  // No provider-side delivery, so hand off to the app.\n  try {\n    await getInviteHandler()?.({\n      email: normalized,\n      role: existing?.role ?? role,\n      siteId,\n      invitedBy: viewer.email ?? viewer.userId,\n    });\n  } catch (e) {\n    console.error(\"Guardrail: onInvite handler threw\", e);\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\nexport async function updateMemberRole(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const target = await members.getMember(siteId, {\n    email: email.toLowerCase().trim(),\n  });\n  if (!target) return { success: false, error: \"No such member.\" };\n\n  if (target.role === \"admin\" && role !== \"admin\") {\n    const guard = await wouldStrandSite(siteId, target.email);\n    if (guard) return guard;\n  }\n\n  const res = await members.upsertMember(siteId, {\n    email: target.email,\n    role,\n    userId: target.userId,\n    status: target.status,\n  });\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nexport async function removeMember(email: string): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n  const normalized = email.toLowerCase().trim();\n\n  const guard = await wouldStrandSite(siteId, normalized);\n  if (guard) return guard;\n\n  const res = await members.removeMember(siteId, normalized);\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nasync function requestOrigin(): Promise<string> {\n  const h = await headers();\n  const origin = h.get(\"origin\");\n  if (origin) return origin;\n  const host = h.get(\"x-forwarded-host\") ?? h.get(\"host\") ?? \"localhost\";\n  const proto = h.get(\"x-forwarded-proto\") ?? (host.startsWith(\"localhost\") ? \"http\" : \"https\");\n  return `${proto}://${host}`;\n}\n\n/**\n * Refuses changes that would leave a site with no admin, which would lock\n * everyone out of team management with no in-app way to recover.\n */\nasync function wouldStrandSite(\n  siteId: string,\n  email: string,\n): Promise<Result | null> {\n  const members = getMembers();\n  const all = await members.listMembers(siteId);\n  const admins = all.filter((m) => m.role === \"admin\");\n\n  if (admins.length <= 1 && admins.some((m) => m.email === email)) {\n    return {\n      success: false,\n      error: \"A site must keep at least one admin.\",\n    };\n  }\n  return null;\n}\n\n/* ---------------------------------------------------------------- auth --- */\n\nexport async function loginAction(\n  _prev: ActionState,\n  formData: FormData,\n): Promise<ActionState> {\n  const email = String(formData.get(\"email\") ?? \"\");\n  const password = String(formData.get(\"password\") ?? \"\");\n\n  const auth = getAuth();\n  if (!auth.authenticate) {\n    return {\n      success: false,\n      error: \"This site's auth provider does not accept passwords.\",\n      email,\n    };\n  }\n\n  const result = await auth.authenticate(email, password);\n  if (!result.success) {\n    return { success: false, error: result.error, email };\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true, email };\n}\n\nexport async function logoutAction(): Promise<{ success: boolean }> {\n  const auth = getAuth();\n  await auth.logout();\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AAajC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAOhE,eAAsB,YACpB,SAC0B;AAC1B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,eAAsB,aAAa,KAAmC;AACpE,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,YAA0B;AAAA,IAC9B,SAAS,IAAI;AAAA,IACb,QAAQ,MAAM,cAAc;AAAA,IAC5B,MAAM,IAAI,MAAM;AAAA,IAChB,OAAO,IAAI;AAAA,EACb;AAEA,MAAI;AACF,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,MAAM,GAAG,YAAY,SAAS;AAC1C,QAAI,CAAC,IAAI,QAAS,QAAO;AAGzB,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0BAA0B,CAAC;AACzC,WAAO,EAAE,SAAS,OAAO,OAAO,yBAAyB;AAAA,EAC3D;AACF;AAMA,MAAM,cAAc,CAAC,aAAa,cAAc,cAAc,aAAa,YAAY;AACvF,MAAM,mBAAmB,KAAK,OAAO;AAMrC,eAAsB,kBAAkB,MAMtC;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,oCAAoC;AAAA,EACtE;AACA,MAAI,CAAC,YAAY,SAAS,KAAK,WAAW,GAAG;AAC3C,WAAO,EAAE,SAAS,OAAO,OAAO,gDAAgD;AAAA,EAClF;AACA,MAAI,EAAE,KAAK,OAAO,MAAM,KAAK,OAAO,kBAAkB;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B;AAAA,EAChE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,cAAc,GAAG,IAAI;AACrE,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,kCAAkC,CAAC;AAIjD,UAAM,SACJ,QAAQ,IAAI,aAAa,gBAAgB,aAAa,QAClD,IAAI,EAAE,OAAO,KACb;AACN,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B,MAAM,GAAG;AAAA,EACzE;AACF;AAEA,eAAsB,aAAiC;AACrD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO,CAAC;AACjC,SAAO,QAAQ,WAAW,MAAM,cAAc,CAAC;AACjD;AAIA,eAAsB,WAAgC;AAEpD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,UAAU,WAAW;AAC3B,SAAO,QAAQ,YAAY,MAAM,cAAc,CAAC;AAClD;AAEA,eAAsB,aACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAC5C,MAAI,CAAC,6BAA6B,KAAK,UAAU,GAAG;AAClD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AAEA,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,EAAE,OAAO,WAAW,CAAC;AACtE,MAAI,UAAU,WAAW,UAAU;AACjC,WAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,EACzE;AAIA,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,MAC7C,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,QAAS,QAAO;AAAA,EAC3B;AAEA,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,YAAY;AAEnB,UAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAAA,MAC7C,YAAY,GAAG,MAAM,cAAc,CAAC;AAAA,IACtC,CAAC;AACD,mBAAe,KAAK,QAAQ;AAC5B,WAAO,KAAK,UACR,EAAE,SAAS,KAAK,IAChB;AAAA,MACE,SAAS;AAAA,MACT,OAAO,uCAAuC,KAAK,KAAK;AAAA,IAC1D;AAAA,EACN;AAGA,MAAI;AACF,UAAM,iBAAiB,IAAI;AAAA,MACzB,OAAO;AAAA,MACP,MAAM,UAAU,QAAQ;AAAA,MACxB;AAAA,MACA,WAAW,OAAO,SAAS,OAAO;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,GAAG;AACV,YAAQ,MAAM,qCAAqC,CAAC;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAsB,iBACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ;AAAA,IAC7C,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAE/D,MAAI,OAAO,SAAS,WAAW,SAAS,SAAS;AAC/C,UAAM,QAAQ,MAAM,gBAAgB,QAAQ,OAAO,KAAK;AACxD,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,IAC7C,OAAO,OAAO;AAAA,IACd;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAsB,aAAa,OAAgC;AACjE,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAE5C,QAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,MAAI,MAAO,QAAO;AAElB,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ,UAAU;AACzD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAe,gBAAiC;AAC9C,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,QAAQ;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,OAAO,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,MAAM,KAAK;AAC3D,QAAM,QAAQ,EAAE,IAAI,mBAAmB,MAAM,KAAK,WAAW,WAAW,IAAI,SAAS;AACrF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAMA,eAAe,gBACb,QACA,OACwB;AACxB,QAAM,UAAU,WAAW;AAC3B,QAAM,MAAM,MAAM,QAAQ,YAAY,MAAM;AAC5C,QAAM,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO;AAEnD,MAAI,OAAO,UAAU,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIA,eAAsB,YACpB,OACA,UACsB;AACtB,QAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAChD,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AAEtD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,cAAc;AACtB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,KAAK,aAAa,OAAO,QAAQ;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,SAAS,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,MAAM,MAAM;AAChC;AAEA,eAAsB,eAA8C;AAClE,QAAM,OAAO,QAAQ;AACrB,QAAM,KAAK,OAAO;AAClB,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;","names":[]}

package/dist/server/data.d.ts

@@ -0,0 +1,10 @@
+import { OverrideRow } from '../core/types.js';
+import 'react';
+
+/**
+ * Server-side fetch for a single field. Runs during SSR/ISR so anonymous
+ * visitors get the real content in the initial HTML.
+ */
+declare function fetchOrScaffold(pathKey: string, props: Record<string, unknown>): Promise<OverrideRow>;
+
+export { fetchOrScaffold };

package/dist/server/data.js

@@ -0,0 +1,24 @@
+import { loadOverride } from "./loader";
+async function fetchOrScaffold(pathKey, props) {
+  const row = await loadOverride(pathKey);
+  return row ?? generateScaffold(pathKey, props);
+}
+function generateScaffold(pathKey, props) {
+  const { children, type, src, alt, href } = props;
+  const defaultText = typeof children === "string" || typeof children === "number" ? String(children) : "";
+  let value;
+  if (type === "image" || src) {
+    value = { type: "image", src: src ?? "", alt: alt ?? "" };
+  } else if (type === "link" || href) {
+    value = { type: "link", href: href ?? "", text: defaultText };
+  } else if (type === "button") {
+    value = { type: "button", text: defaultText };
+  } else {
+    value = { type: "text", text: defaultText };
+  }
+  return { id: `scaffold-${pathKey}`, pathKey, value };
+}
+export {
+  fetchOrScaffold
+};
+//# sourceMappingURL=data.js.map

package/dist/server/data.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/data.ts"],"sourcesContent":["import type { OverrideRow, OverrideValue } from \"../core/types\";\nimport { loadOverride } from \"./loader\";\n\n/**\n * Server-side fetch for a single field. Runs during SSR/ISR so anonymous\n * visitors get the real content in the initial HTML.\n */\nexport async function fetchOrScaffold(\n  pathKey: string,\n  props: Record<string, unknown>,\n): Promise<OverrideRow> {\n  // Adapters normalize storage quirks (stringified JSON, column naming), so\n  // anything returned here is already a domain-shaped row.\n  const row = await loadOverride(pathKey);\n  return row ?? generateScaffold(pathKey, props);\n}\n\n/**\n * Builds a default row from the JSX the developer already wrote, so an\n * un-edited field renders its hardcoded content. Deliberately does not write\n * to the database — nothing is persisted until an editor saves.\n */\nfunction generateScaffold(\n  pathKey: string,\n  props: Record<string, unknown>,\n): OverrideRow {\n  const { children, type, src, alt, href } = props as {\n    children?: unknown;\n    type?: string;\n    src?: string;\n    alt?: string;\n    href?: string;\n  };\n\n  const defaultText =\n    typeof children === \"string\" || typeof children === \"number\"\n      ? String(children)\n      : \"\";\n\n  let value: OverrideValue;\n\n  if (type === \"image\" || src) {\n    value = { type: \"image\", src: src ?? \"\", alt: alt ?? \"\" };\n  } else if (type === \"link\" || href) {\n    value = { type: \"link\", href: href ?? \"\", text: defaultText };\n  } else if (type === \"button\") {\n    value = { type: \"button\", text: defaultText };\n  } else {\n    value = { type: \"text\", text: defaultText };\n  }\n\n  return { id: `scaffold-${pathKey}`, pathKey, value };\n}\n"],"mappings":"AACA,SAAS,oBAAoB;AAM7B,eAAsB,gBACpB,SACA,OACsB;AAGtB,QAAM,MAAM,MAAM,aAAa,OAAO;AACtC,SAAO,OAAO,iBAAiB,SAAS,KAAK;AAC/C;AAOA,SAAS,iBACP,SACA,OACa;AACb,QAAM,EAAE,UAAU,MAAM,KAAK,KAAK,KAAK,IAAI;AAQ3C,QAAM,cACJ,OAAO,aAAa,YAAY,OAAO,aAAa,WAChD,OAAO,QAAQ,IACf;AAEN,MAAI;AAEJ,MAAI,SAAS,WAAW,KAAK;AAC3B,YAAQ,EAAE,MAAM,SAAS,KAAK,OAAO,IAAI,KAAK,OAAO,GAAG;AAAA,EAC1D,WAAW,SAAS,UAAU,MAAM;AAClC,YAAQ,EAAE,MAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,YAAY;AAAA,EAC9D,WAAW,SAAS,UAAU;AAC5B,YAAQ,EAAE,MAAM,UAAU,MAAM,YAAY;AAAA,EAC9C,OAAO;AACL,YAAQ,EAAE,MAAM,QAAQ,MAAM,YAAY;AAAA,EAC5C;AAEA,SAAO,EAAE,IAAI,YAAY,OAAO,IAAI,SAAS,MAAM;AACrD;","names":[]}

package/dist/server/fieldData.d.ts

@@ -0,0 +1,26 @@
+import { OverrideValue } from '../core/types.js';
+import 'react';
+
+/**
+ * Reads a field's current value with no rendering attached.
+ *
+ * <GRail> covers "render this as an editable element." This covers "give me
+ * the data so I can build something GRail doesn't render itself" — an embed
+ * iframe's src, an og:image meta tag, structured data, a third-party widget's
+ * config.
+ *
+ * Read-only: this does not make a field editable on its own. Give the same
+ * id a normal <GRail> somewhere for an editor to change it; this just reads
+ * whatever that field currently holds.
+ *
+ * Shares <GRail>'s request-scoped batching loader, so calling this alongside
+ * other fields — including several of these via Promise.all — still resolves
+ * in one query, not one per call.
+ *
+ * Returns null when nothing has been saved yet. There is no `children`
+ * fallback to fall back to here, since nothing is rendered — supply your own
+ * default in the calling code.
+ */
+declare function getFieldValue(id: string): Promise<OverrideValue | null>;
+
+export { getFieldValue };

package/dist/server/fieldData.js

@@ -0,0 +1,9 @@
+import { loadOverride } from "./loader";
+async function getFieldValue(id) {
+  const row = await loadOverride(id);
+  return row?.value ?? null;
+}
+export {
+  getFieldValue
+};
+//# sourceMappingURL=fieldData.js.map

package/dist/server/fieldData.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/fieldData.ts"],"sourcesContent":["import { loadOverride } from \"./loader\";\nimport type { OverrideValue } from \"../core/types\";\n\n/**\n * Reads a field's current value with no rendering attached.\n *\n * <GRail> covers \"render this as an editable element.\" This covers \"give me\n * the data so I can build something GRail doesn't render itself\" — an embed\n * iframe's src, an og:image meta tag, structured data, a third-party widget's\n * config.\n *\n * Read-only: this does not make a field editable on its own. Give the same\n * id a normal <GRail> somewhere for an editor to change it; this just reads\n * whatever that field currently holds.\n *\n * Shares <GRail>'s request-scoped batching loader, so calling this alongside\n * other fields — including several of these via Promise.all — still resolves\n * in one query, not one per call.\n *\n * Returns null when nothing has been saved yet. There is no `children`\n * fallback to fall back to here, since nothing is rendered — supply your own\n * default in the calling code.\n */\nexport async function getFieldValue(id: string): Promise<OverrideValue | null> {\n  const row = await loadOverride(id);\n  return row?.value ?? null;\n}\n"],"mappings":"AAAA,SAAS,oBAAoB;AAuB7B,eAAsB,cAAc,IAA2C;AAC7E,QAAM,MAAM,MAAM,aAAa,EAAE;AACjC,SAAO,KAAK,SAAS;AACvB;","names":[]}

package/dist/server/loader.d.ts

@@ -0,0 +1,6 @@
+import { OverrideRow } from '../core/types.js';
+import 'react';
+
+declare function loadOverride(pathKey: string): Promise<OverrideRow | null>;
+
+export { loadOverride };

package/dist/server/loader.js

@@ -0,0 +1,53 @@
+import { cache } from "react";
+import { getDB, resolveSiteId } from "../core/config";
+import { rethrowIfBailout } from "../core/bailout";
+const getLoader = cache(() => {
+  let pending = [];
+  let scheduled = false;
+  const flush = async () => {
+    const batch = pending;
+    pending = [];
+    scheduled = false;
+    if (batch.length === 0) return;
+    const keys = [...new Set(batch.map((p) => p.key))];
+    try {
+      const db = getDB();
+      const siteId = await resolveSiteId();
+      const started = Date.now();
+      const rows = await db.getOverrides(keys, siteId);
+      if (process.env.GUARDRAIL_DEBUG) {
+        console.log(
+          `[guardrail] batch: ${keys.length} key(s) -> ${rows.length} row(s) in 1 query (${Date.now() - started}ms) site=${siteId} keys=${keys.join(", ")}`
+        );
+      }
+      const byKey = new Map(rows.map((r) => [r.pathKey, r]));
+      for (const p of batch) p.resolve(byKey.get(p.key) ?? null);
+    } catch (e) {
+      for (const p of batch) p.reject(e);
+    }
+  };
+  return {
+    load(key) {
+      return new Promise((resolve, reject) => {
+        pending.push({ key, resolve, reject });
+        if (!scheduled) {
+          scheduled = true;
+          queueMicrotask(flush);
+        }
+      });
+    }
+  };
+});
+async function loadOverride(pathKey) {
+  try {
+    return await getLoader().load(pathKey);
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: failed to load override", e);
+    return null;
+  }
+}
+export {
+  loadOverride
+};
+//# sourceMappingURL=loader.js.map

package/dist/server/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/loader.ts"],"sourcesContent":["import { cache } from \"react\";\nimport { getDB, resolveSiteId } from \"../core/config\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { OverrideRow } from \"../core/types\";\n\ninterface Pending {\n  key: string;\n  resolve: (row: OverrideRow | null) => void;\n  reject: (error: unknown) => void;\n}\n\n/**\n * Request-scoped batching loader.\n *\n * Every <GRail> resolves its own field, so a naive implementation issues one\n * query per field. This collects the keys requested within a microtask and\n * flushes them as a single query. React renders siblings concurrently, so a\n * page's fields land in the same batch; a field nested behind another await\n * simply falls into a later batch rather than degrading to one query each.\n *\n * cache() scopes the queue to a single request so keys never leak between\n * concurrent renders.\n */\nconst getLoader = cache(() => {\n  let pending: Pending[] = [];\n  let scheduled = false;\n\n  const flush = async () => {\n    const batch = pending;\n    pending = [];\n    scheduled = false;\n    if (batch.length === 0) return;\n\n    // One lookup per distinct key, even if several fields share it.\n    const keys = [...new Set(batch.map((p) => p.key))];\n\n    try {\n      const db = getDB();\n      const siteId = await resolveSiteId();\n      const started = Date.now();\n      const rows = await db.getOverrides(keys, siteId);\n\n      if (process.env.GUARDRAIL_DEBUG) {\n        console.log(\n          `[guardrail] batch: ${keys.length} key(s) -> ${rows.length} row(s) ` +\n            `in 1 query (${Date.now() - started}ms) ` +\n            `site=${siteId} keys=${keys.join(\", \")}`,\n        );\n      }\n      const byKey = new Map(rows.map((r) => [r.pathKey, r]));\n      for (const p of batch) p.resolve(byKey.get(p.key) ?? null);\n    } catch (e) {\n      for (const p of batch) p.reject(e);\n    }\n  };\n\n  return {\n    load(key: string): Promise<OverrideRow | null> {\n      return new Promise<OverrideRow | null>((resolve, reject) => {\n        pending.push({ key, resolve, reject });\n        if (!scheduled) {\n          scheduled = true;\n          queueMicrotask(flush);\n        }\n      });\n    },\n  };\n});\n\nexport async function loadOverride(\n  pathKey: string,\n): Promise<OverrideRow | null> {\n  try {\n    return await getLoader().load(pathKey);\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: failed to load override\", e);\n    return null;\n  }\n}\n"],"mappings":"AAAA,SAAS,aAAa;AACtB,SAAS,OAAO,qBAAqB;AACrC,SAAS,wBAAwB;AAqBjC,MAAM,YAAY,MAAM,MAAM;AAC5B,MAAI,UAAqB,CAAC;AAC1B,MAAI,YAAY;AAEhB,QAAM,QAAQ,YAAY;AACxB,UAAM,QAAQ;AACd,cAAU,CAAC;AACX,gBAAY;AACZ,QAAI,MAAM,WAAW,EAAG;AAGxB,UAAM,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEjD,QAAI;AACF,YAAM,KAAK,MAAM;AACjB,YAAM,SAAS,MAAM,cAAc;AACnC,YAAM,UAAU,KAAK,IAAI;AACzB,YAAM,OAAO,MAAM,GAAG,aAAa,MAAM,MAAM;AAE/C,UAAI,QAAQ,IAAI,iBAAiB;AAC/B,gBAAQ;AAAA,UACN,sBAAsB,KAAK,MAAM,cAAc,KAAK,MAAM,uBACzC,KAAK,IAAI,IAAI,OAAO,YAC3B,MAAM,SAAS,KAAK,KAAK,IAAI,CAAC;AAAA,QAC1C;AAAA,MACF;AACA,YAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AACrD,iBAAW,KAAK,MAAO,GAAE,QAAQ,MAAM,IAAI,EAAE,GAAG,KAAK,IAAI;AAAA,IAC3D,SAAS,GAAG;AACV,iBAAW,KAAK,MAAO,GAAE,OAAO,CAAC;AAAA,IACnC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,KAAK,KAA0C;AAC7C,aAAO,IAAI,QAA4B,CAAC,SAAS,WAAW;AAC1D,gBAAQ,KAAK,EAAE,KAAK,SAAS,OAAO,CAAC;AACrC,YAAI,CAAC,WAAW;AACd,sBAAY;AACZ,yBAAe,KAAK;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC;AAED,eAAsB,aACpB,SAC6B;AAC7B,MAAI;AACF,WAAO,MAAM,UAAU,EAAE,KAAK,OAAO;AAAA,EACvC,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,sCAAsC,CAAC;AACrD,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/server/repeaterActions.d.ts

@@ -0,0 +1,20 @@
+import { GRRepeaterItem } from '../core/types.js';
+import 'react';
+
+type Result = {
+    success: boolean;
+    error?: string;
+};
+declare function addRepeaterItem(repeaterId: string, options?: {
+    slug?: string;
+}): Promise<{
+    success: true;
+    item: GRRepeaterItem;
+} | {
+    success: false;
+    error: string;
+}>;
+declare function removeRepeaterItem(repeaterId: string, itemId: string): Promise<Result>;
+declare function reorderRepeaterItems(repeaterId: string, orderedItemIds: string[]): Promise<Result>;
+
+export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems };

package/dist/server/repeaterActions.js

@@ -0,0 +1,72 @@
+"use server";
+import { revalidatePath } from "next/cache";
+import { getDB, getRepeaters, resolveSiteId } from "../core/config";
+import { requireRole } from "./actions";
+import { rethrowIfBailout } from "../core/bailout";
+const DENIED = { success: false, error: "Unauthorized." };
+async function addRepeaterItem(repeaterId, options) {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return { success: false, error: "Unauthorized." };
+  if (options?.slug !== void 0) {
+    const slug = options.slug.trim();
+    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {
+      return {
+        success: false,
+        error: "Use lowercase letters, numbers, and hyphens only."
+      };
+    }
+    options = { slug };
+  }
+  try {
+    const repeaters = getRepeaters();
+    const res = await repeaters.addItem(repeaterId, await resolveSiteId(), options);
+    if (res.success) revalidatePath("/", "layout");
+    return res;
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: addRepeaterItem failed", e);
+    return { success: false, error: "Could not add the item." };
+  }
+}
+async function removeRepeaterItem(repeaterId, itemId) {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return DENIED;
+  try {
+    const siteId = await resolveSiteId();
+    const repeaters = getRepeaters();
+    const res = await repeaters.removeItem(repeaterId, siteId, itemId);
+    if (!res.success) return res;
+    const db = getDB();
+    await db.deleteOverrides?.(`${repeaterId}.${itemId}.`, siteId);
+    revalidatePath("/", "layout");
+    return { success: true };
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: removeRepeaterItem failed", e);
+    return { success: false, error: "Could not remove the item." };
+  }
+}
+async function reorderRepeaterItems(repeaterId, orderedItemIds) {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return DENIED;
+  try {
+    const repeaters = getRepeaters();
+    const res = await repeaters.reorderItems(
+      repeaterId,
+      await resolveSiteId(),
+      orderedItemIds
+    );
+    if (res.success) revalidatePath("/", "layout");
+    return res;
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: reorderRepeaterItems failed", e);
+    return { success: false, error: "Could not reorder the items." };
+  }
+}
+export {
+  addRepeaterItem,
+  removeRepeaterItem,
+  reorderRepeaterItems
+};
+//# sourceMappingURL=repeaterActions.js.map

package/dist/server/repeaterActions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/repeaterActions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { getDB, getRepeaters, resolveSiteId } from \"../core/config\";\nimport { requireRole } from \"./actions\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRRepeaterItem } from \"../core/types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\nexport async function addRepeaterItem(\n  repeaterId: string,\n  options?: { slug?: string },\n): Promise<\n  { success: true; item: GRRepeaterItem } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  if (options?.slug !== undefined) {\n    const slug = options.slug.trim();\n    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {\n      return {\n        success: false,\n        error: \"Use lowercase letters, numbers, and hyphens only.\",\n      };\n    }\n    options = { slug };\n  }\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.addItem(repeaterId, await resolveSiteId(), options);\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: addRepeaterItem failed\", e);\n    return { success: false, error: \"Could not add the item.\" };\n  }\n}\n\nexport async function removeRepeaterItem(\n  repeaterId: string,\n  itemId: string,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const siteId = await resolveSiteId();\n    const repeaters = getRepeaters();\n    const res = await repeaters.removeItem(repeaterId, siteId, itemId);\n    if (!res.success) return res;\n\n    // Best-effort: an adapter that can't do this cheaply just leaves the old\n    // field values behind, unreachable but harmless.\n    const db = getDB();\n    await db.deleteOverrides?.(`${repeaterId}.${itemId}.`, siteId);\n\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: removeRepeaterItem failed\", e);\n    return { success: false, error: \"Could not remove the item.\" };\n  }\n}\n\nexport async function reorderRepeaterItems(\n  repeaterId: string,\n  orderedItemIds: string[],\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.reorderItems(\n      repeaterId,\n      await resolveSiteId(),\n      orderedItemIds,\n    );\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: reorderRepeaterItems failed\", e);\n    return { success: false, error: \"Could not reorder the items.\" };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,OAAO,cAAc,qBAAqB;AACnD,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AAKjC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAEhE,eAAsB,gBACpB,YACA,SAGA;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AACA,cAAU,EAAE,KAAK;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,QAAQ,YAAY,MAAM,cAAc,GAAG,OAAO;AAC9E,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,qCAAqC,CAAC;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAAA,EAC5D;AACF;AAEA,eAAsB,mBACpB,YACA,QACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,SAAS,MAAM,cAAc;AACnC,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,WAAW,YAAY,QAAQ,MAAM;AACjE,QAAI,CAAC,IAAI,QAAS,QAAO;AAIzB,UAAM,KAAK,MAAM;AACjB,UAAM,GAAG,kBAAkB,GAAG,UAAU,IAAI,MAAM,KAAK,MAAM;AAE7D,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,wCAAwC,CAAC;AACvD,WAAO,EAAE,SAAS,OAAO,OAAO,6BAA6B;AAAA,EAC/D;AACF;AAEA,eAAsB,qBACpB,YACA,gBACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA,MAAM,cAAc;AAAA,MACpB;AAAA,IACF;AACA,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0CAA0C,CAAC;AACzD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AACF;","names":[]}

package/dist/server/repeaterData.d.ts

@@ -0,0 +1,18 @@
+import { GRRepeaterItem } from '../core/types.js';
+import 'react';
+
+/**
+ * Public read: anyone rendering the page needs to enumerate items, same trust
+ * level as fetchOrScaffold. Not a "use server" export — it is meant to be
+ * called from Server Components (a page's own dynamic route, generateStaticParams),
+ * not invoked from client code as an action.
+ */
+declare function listRepeaterItems(repeaterId: string): Promise<GRRepeaterItem[]>;
+/**
+ * Resolves a routed item by its URL segment. Built for a developer's own
+ * `[slug]/page.tsx` — call it, and 404 (via Next's notFound()) when it comes
+ * back null, the same way you would for any other missing record.
+ */
+declare function getRepeaterItemBySlug(repeaterId: string, slug: string): Promise<GRRepeaterItem | null>;
+
+export { getRepeaterItemBySlug, listRepeaterItems };

package/dist/server/repeaterData.js

@@ -0,0 +1,27 @@
+import { getRepeaters, resolveSiteId } from "../core/config";
+import { rethrowIfBailout } from "../core/bailout";
+async function listRepeaterItems(repeaterId) {
+  try {
+    const repeaters = getRepeaters();
+    return await repeaters.listItems(repeaterId, await resolveSiteId());
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: failed to list repeater items", e);
+    return [];
+  }
+}
+async function getRepeaterItemBySlug(repeaterId, slug) {
+  try {
+    const repeaters = getRepeaters();
+    return await repeaters.getItemBySlug(repeaterId, await resolveSiteId(), slug);
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: failed to resolve repeater item by slug", e);
+    return null;
+  }
+}
+export {
+  getRepeaterItemBySlug,
+  listRepeaterItems
+};
+//# sourceMappingURL=repeaterData.js.map

package/dist/server/repeaterData.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/repeaterData.ts"],"sourcesContent":["import { getRepeaters, resolveSiteId } from \"../core/config\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRRepeaterItem } from \"../core/types\";\n\n/**\n * Public read: anyone rendering the page needs to enumerate items, same trust\n * level as fetchOrScaffold. Not a \"use server\" export — it is meant to be\n * called from Server Components (a page's own dynamic route, generateStaticParams),\n * not invoked from client code as an action.\n */\nexport async function listRepeaterItems(\n  repeaterId: string,\n): Promise<GRRepeaterItem[]> {\n  try {\n    const repeaters = getRepeaters();\n    return await repeaters.listItems(repeaterId, await resolveSiteId());\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: failed to list repeater items\", e);\n    return [];\n  }\n}\n\n/**\n * Resolves a routed item by its URL segment. Built for a developer's own\n * `[slug]/page.tsx` — call it, and 404 (via Next's notFound()) when it comes\n * back null, the same way you would for any other missing record.\n */\nexport async function getRepeaterItemBySlug(\n  repeaterId: string,\n  slug: string,\n): Promise<GRRepeaterItem | null> {\n  try {\n    const repeaters = getRepeaters();\n    return await repeaters.getItemBySlug(repeaterId, await resolveSiteId(), slug);\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: failed to resolve repeater item by slug\", e);\n    return null;\n  }\n}\n"],"mappings":"AAAA,SAAS,cAAc,qBAAqB;AAC5C,SAAS,wBAAwB;AASjC,eAAsB,kBACpB,YAC2B;AAC3B,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,WAAO,MAAM,UAAU,UAAU,YAAY,MAAM,cAAc,CAAC;AAAA,EACpE,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,4CAA4C,CAAC;AAC3D,WAAO,CAAC;AAAA,EACV;AACF;AAOA,eAAsB,sBACpB,YACA,MACgC;AAChC,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,WAAO,MAAM,UAAU,cAAc,YAAY,MAAM,cAAc,GAAG,IAAI;AAAA,EAC9E,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,sDAAsD,CAAC;AACrE,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/server/session.d.ts

@@ -0,0 +1,14 @@
+import { GRViewer } from '../core/types.js';
+import 'react';
+
+/**
+ * Request-scoped identity + role resolution.
+ *
+ * Every <GRail> needs to know whether an editor is present; React's cache()
+ * collapses that into one verification per render pass rather than one per
+ * field. Identity comes from the auth adapter, the role from Guardrail's
+ * membership store — the two are resolved separately and never conflated.
+ */
+declare const getCachedViewer: () => Promise<GRViewer | null>;
+
+export { getCachedViewer };

package/dist/server/session.js

@@ -0,0 +1,37 @@
+import { cache } from "react";
+import { getAuth, getMembers, resolveSiteId } from "../core/config";
+import { rethrowIfBailout } from "../core/bailout";
+const getCachedViewer = cache(async () => {
+  try {
+    const auth = getAuth();
+    const session = await auth.getSession();
+    if (!session) return null;
+    const siteId = await resolveSiteId();
+    const members = getMembers();
+    const email = session.email?.toLowerCase().trim();
+    const byUser = await members.getMember(siteId, { userId: session.userId });
+    if (byUser) {
+      return { userId: session.userId, email: session.email, role: byUser.role };
+    }
+    if (email) {
+      const invited = await members.getMember(siteId, { email });
+      if (invited && invited.status === "pending") {
+        await members.claimInvite(siteId);
+        return {
+          userId: session.userId,
+          email: session.email,
+          role: invited.role
+        };
+      }
+    }
+    return { userId: session.userId, email: session.email, role: null };
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: viewer resolution failed", e);
+    return null;
+  }
+});
+export {
+  getCachedViewer
+};
+//# sourceMappingURL=session.js.map

package/dist/server/session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/session.ts"],"sourcesContent":["import { cache } from \"react\";\nimport { getAuth, getMembers, resolveSiteId } from \"../core/config\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRViewer } from \"../core/types\";\n\n/**\n * Request-scoped identity + role resolution.\n *\n * Every <GRail> needs to know whether an editor is present; React's cache()\n * collapses that into one verification per render pass rather than one per\n * field. Identity comes from the auth adapter, the role from Guardrail's\n * membership store — the two are resolved separately and never conflated.\n */\nexport const getCachedViewer = cache(async (): Promise<GRViewer | null> => {\n  try {\n    const auth = getAuth();\n    const session = await auth.getSession();\n    if (!session) return null;\n\n    const siteId = await resolveSiteId();\n    const members = getMembers();\n    const email = session.email?.toLowerCase().trim();\n\n    // 1. Already a member of this site.\n    const byUser = await members.getMember(siteId, { userId: session.userId });\n    if (byUser) {\n      return { userId: session.userId, email: session.email, role: byUser.role };\n    }\n\n    // 2. Claim a pending invitation addressed to this email. The adapter binds\n    // it server-side; the role it was invited with is not ours to choose.\n    if (email) {\n      const invited = await members.getMember(siteId, { email });\n      if (invited && invited.status === \"pending\") {\n        await members.claimInvite(siteId);\n        return {\n          userId: session.userId,\n          email: session.email,\n          role: invited.role,\n        };\n      }\n    }\n\n    // Signed in, but holds no role here. There is deliberately no self-service\n    // path to a role: the first admin is seeded in SQL (see supabase/migrations).\n    return { userId: session.userId, email: session.email, role: null };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: viewer resolution failed\", e);\n    return null;\n  }\n});\n"],"mappings":"AAAA,SAAS,aAAa;AACtB,SAAS,SAAS,YAAY,qBAAqB;AACnD,SAAS,wBAAwB;AAW1B,MAAM,kBAAkB,MAAM,YAAsC;AACzE,MAAI;AACF,UAAM,OAAO,QAAQ;AACrB,UAAM,UAAU,MAAM,KAAK,WAAW;AACtC,QAAI,CAAC,QAAS,QAAO;AAErB,UAAM,SAAS,MAAM,cAAc;AACnC,UAAM,UAAU,WAAW;AAC3B,UAAM,QAAQ,QAAQ,OAAO,YAAY,EAAE,KAAK;AAGhD,UAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC;AACzE,QAAI,QAAQ;AACV,aAAO,EAAE,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,OAAO,MAAM,OAAO,KAAK;AAAA,IAC3E;AAIA,QAAI,OAAO;AACT,YAAM,UAAU,MAAM,QAAQ,UAAU,QAAQ,EAAE,MAAM,CAAC;AACzD,UAAI,WAAW,QAAQ,WAAW,WAAW;AAC3C,cAAM,QAAQ,YAAY,MAAM;AAChC,eAAO;AAAA,UACL,QAAQ,QAAQ;AAAA,UAChB,OAAO,QAAQ;AAAA,UACf,MAAM,QAAQ;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAIA,WAAO,EAAE,QAAQ,QAAQ,QAAQ,OAAO,QAAQ,OAAO,MAAM,KAAK;AAAA,EACpE,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,uCAAuC,CAAC;AACtD,WAAO;AAAA,EACT;AACF,CAAC;","names":[]}

package/dist/server/wrapper.d.ts

@@ -0,0 +1,12 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import React from 'react';
+import { GRConfig } from '../core/adapter-types.js';
+import '../core/types.js';
+
+/**
+ * Wraps a root layout so every route carries Guardrail's edit state and admin
+ * chrome. Stays a Server Component: the provider below is the client boundary.
+ */
+declare function withGuardrail<P extends object>(LayoutComponent: React.ComponentType<P>, config: GRConfig): (props: P) => Promise<react_jsx_runtime.JSX.Element>;
+
+export { withGuardrail };