@guard-rail/core 0.10.0 → 0.12.0

package/README.md

@@ -435,6 +435,43 @@ scratch. A visual page builder (Puck, say) is a better fit for that and can
 sit alongside `<GRepeater>` later — it would decide composition, while
 `<GRail>` still owns each block's leaf content.
 
+## Reverting a change
+
+Every editor popup has a circular-arrow **revert** button next to save and close.
+It steps one version back:
+
+- If the field was edited more than once, it restores the **previous saved value**
+  — the button reads "Revert to the version from Oct 28".
+- If there's nothing earlier, it removes the saved value so the field shows the
+  **default written in the page** — the button reads "Reset to default".
+- If the field has nothing saved, the button isn't shown.
+
+The field updates in place, and everyone else sees the change straight away. There's
+no confirmation step; the label says what it will do.
+
+Behind it, each save that changes a field's value moves the old value into a
+separate `gr_content_history` table, which only editors of the site can read (the
+public `gr_content` table still holds just the current value). Saving the same value
+again records nothing. History is kept for the newest **20 versions of each field**
+and for **90 days**, whichever is less, and is cleaned up as part of saving — no
+scheduled job. Removing a field (a deleted repeater item, say) removes its history.
+
+Things to know:
+
+- **Images:** reverting restores the earlier reference. Uploaded files aren't
+  deleted, so they stay in the media picker for reuse.
+- **Repeaters:** a field inside an item reverts like any other. Adding, removing and
+  reordering items isn't part of history.
+- **Existing content has no history yet.** Revert becomes available after a field's
+  next edit.
+- **It needs the `content_history` migration.** Without it, the button just doesn't
+  appear. `pnpm exec guardrail-init-db --push`, or `guardrail-doctor --fix --push`,
+  applies it.
+
+Building your own editing UI? `getRevertInfo(id)` reports what a revert would do
+(`{ kind: "previous" | "default" | "none", at }`) and `revertField(id)` does it. Both
+check the caller is an editor or admin.
+
 ## Custom editing UI
 
 `<GRail>` edits what's on the page. Some fields have nothing to click — an SEO
@@ -447,6 +484,8 @@ authorization in Guardrail's hands:
   field; pass `{ type: "image", src, alt }` etc. for the others. It checks the
   caller is an editor or admin itself, and writes the same row a `<GRail>` with
   that id would, so the two stay interchangeable.
+- **`getRevertInfo(id)` / `revertField(id)`** report and perform a one-step revert
+  (see "Reverting a change").
 - **`isEditor()` / `isAdmin()`** are the role checks for your *own* Server
   Actions. `isEditor()` is true for editors and admins; `isAdmin()` only for
   admins (team management).
@@ -496,6 +535,54 @@ the outline ignores the pointer so your overlaid content stays fully clickable,
 and the handle is the only thing that opens the editor (it also won't trigger a
 surrounding `<Link>`).
 
+### Theming
+
+The chrome is a real stylesheet (`guardrail.css`) that the package imports itself —
+there is nothing to link by hand, and no inline styles, so it works under a strict
+Content-Security-Policy. Every color is a CSS variable, so restyling it is a plain
+`:root` rule in your own CSS:
+
+```css
+:root {
+  --gr-accent: #7c3aed;
+  --gr-field-outline: #7c3aed;
+  --gr-overlay-bg: #1e1b4b;
+  --gr-overlay-fg: #e0e7ff;
+}
+```
+
+No `!important` and no selector tricks: Guardrail's defaults are declared with zero
+specificity, so your `:root` rule wins whichever stylesheet loads first.
+
+There are two layers. Change a **base** color to retheme everything, or set an
+**overlay** color to restyle only the floating surfaces (the sign-in bar, toolbar,
+edit popups, drawers and image picker). The overlay variables default to the base
+ones, so you only set what you want to differ.
+
+| Variable | What it colors |
+|---|---|
+| `--gr-overlay-bg` | Background of the sign-in bar, popups, drawers and picker |
+| `--gr-overlay-bg-glass` | Background of the toolbar and the inline editing bar (translucent) |
+| `--gr-overlay-fg` | Text on all of the above |
+| `--gr-overlay-border` | Their borders |
+| `--gr-field-outline` | The dashed outline around an editable field |
+| `--gr-field-outline-active` | The solid outline while a field is being edited |
+| `--gr-accent`, `--gr-accent-soft`, `--gr-accent-text`, `--gr-on-accent` | Highlights, and text on an accent background |
+| `--gr-primary-bg`, `--gr-primary-fg` | Primary buttons |
+| `--gr-danger`, `--gr-label`, `--gr-badge-bg`, `--gr-badge-fg` | Errors, small labels, the "pending" badge |
+| `--gr-scrim`, `--gr-scrim-modal` | The dimmed backdrop behind drawers and the picker |
+| `--gr-bg`, `--gr-bg-glass`, `--gr-fg`, `--gr-fg2`, `--gr-muted`, `--gr-subtle`, `--gr-border`, `--gr-border-strong`, `--gr-border-soft`, `--gr-input-bg`, `--gr-soft`, `--gr-shadow` | The base palette the overlay variables fall back to, plus inputs and secondary text |
+
+Set any of them inside `@media (prefers-color-scheme: dark)` if you want a
+different value in dark mode — the chrome follows the visitor's OS setting. The
+outline around an editable text field is `[data-gr-field="text"]` (and
+`[data-gr-editing]` while it's being edited), so you can restyle or hide it with a
+rule of your own; to hide it, set `--gr-field-outline: transparent`. Every class
+Guardrail adds is prefixed `gr-`.
+
+If your setup doesn't bundle CSS imported from a package, import it yourself once,
+in your root layout: `import "@guard-rail/core/styles.css";`.
+
 ## Extending the toolbar
 
 The bundled toolbar (edit indicator, Team, Exit edit mode) has one extension point:
@@ -576,6 +663,13 @@ work inside Client Components (see above): one round trip returning the site's r
 and whether the list was cut off at `limit`. An adapter without it still works
 fully for Server Components — client-rendered fields just show their JSX fallback.
 
+`getRevertInfo(pathKey, siteId)` and `revertOverride(pathKey, siteId)` are optional and
+go together: they back the revert button (see "Reverting a change"). `getRevertInfo`
+returns `{ kind: "previous" | "default" | "none", at? }`; `revertOverride` restores the
+previous saved value (returning it) or removes the saved value, and reports which.
+An adapter without them simply never shows the button — keeping the history is up to
+your backend.
+
 `getOverrides(pathKeys, siteId)` is batched by design — it receives every key a
 render pass needs, already deduplicated. Adapters map their own storage naming
 at this boundary; core speaks `pathKey` / `siteId` only.
@@ -612,14 +706,15 @@ By default it only reads. It checks:
   `supabase/migrations/`, that `next.config` sets anti-framing headers, and that
   the root layout uses `withGuardrail()`.
 - **Database:** that the `guardrail` schema is exposed, the tables and functions
-  exist, rate limiting works, and what your project's sign-up settings are
+  exist (including the revert history), rate limiting works, and what your project's sign-up settings are
   (whether **Confirm email** is on).
 
 | Flag | What it adds |
 |---|---|
 | `--fix` | Repairs what can be repaired in local files: copies missing migrations, adds a `GUARDRAIL_SITE_URL` note to `.env.example` / `.env.local`, adds baseline security headers to `next.config`. It never changes secrets or Supabase dashboard settings, and re-running it is safe. Add `--push` to also run `supabase db push`. |
-| `--app-url=http://localhost:3000` | Also checks the response headers of a running copy of your site. |
-| `--e2e` | Runs an end-to-end suite against the database. It creates a throwaway user, a few rows and a test image, then exercises sign-in, claiming an invitation, row-level security (an editor can write their own site and nobody else's; visitors can read but not write), the last-admin guard, rate limiting and image uploads, and deletes everything it made. It asks before touching a database that isn't local (`--yes` skips the question), and needs the service-role key. |
+| `--app-url=http://localhost:3000` | Also checks the response headers of a running copy of your site, including that Guardrail's stylesheet reached the page and that its Content-Security-Policy lets Guardrail's uploads and images through. |
+| `--e2e` | Runs an end-to-end suite against the database. It creates a throwaway user, a few rows and a test image, then exercises sign-in, claiming an invitation, row-level security (an editor can write their own site and nobody else's; visitors can read but not write), reverting and the history limits, the last-admin guard, rate limiting and image uploads, and deletes everything it made. It asks before touching a database that isn't local (`--yes` skips the question), and needs the service-role key. |
+| `--csp` | Prints a starter `Content-Security-Policy-Report-Only` header built from your `SUPABASE_URL` and exits. |
 | `--offline` | Skips the advisory lookup (the only network call besides your own Supabase project). Package names and versions are what's sent otherwise, as with `pnpm audit`; offline, Next.js is checked against a built-in list that may be out of date. |
 | `--production` | Treats production-only requirements as failures instead of warnings. |
 | `--strict` / `--json` | Exit non-zero on warnings too; machine-readable output for CI. |
@@ -737,6 +832,42 @@ Run `pnpm exec guardrail-doctor --production` to check everything below.
 - **Add security headers** in `next.config`: at least a `Content-Security-Policy`
   with `frame-ancestors 'self'` (so the editing chrome can't be framed by another
   site), `Strict-Transport-Security`, and `X-Content-Type-Options: nosniff`.
+  `guardrail-doctor --fix` adds this baseline. For a policy that also restricts
+  scripts and styles, see "Content Security Policy" below.
+
+### Content Security Policy
+
+Guardrail works under a strict policy — no `'unsafe-inline'` for styles and no
+nonce. Its chrome is a stylesheet, and it renders no inline scripts and uses no
+`eval`. A strict policy only has to allow the two places the browser talks to
+Supabase directly:
+
+| Directive | Allow | Why |
+|---|---|---|
+| `connect-src` | `'self'` and your Supabase origin | image uploads are sent straight from the browser to Supabase storage |
+| `img-src` | `'self'` and your Supabase origin | uploaded images and the media picker's thumbnails load from storage |
+| `style-src` | `'self'` | nothing more |
+| `frame-ancestors` | `'self'` | so the editing chrome can't be framed by another site |
+
+Everything else — reads, saves, sign-in — goes through your own server, i.e.
+`'self'`. If you build the header in code, `guardrailCspDirectives()` returns
+these for you to merge into your own:
+
+```ts
+import { guardrailCspDirectives, cspString } from "@guard-rail/core";
+
+const gr = guardrailCspDirectives({ supabaseUrl: process.env.SUPABASE_URL });
+// gr["connect-src"] -> ["'self'", "https://abc.supabase.co"]
+// cspString(gr)     -> "style-src 'self'; img-src 'self' https://abc.supabase.co; …"
+```
+
+To get started, `pnpm exec guardrail-doctor --csp` prints a starter
+`Content-Security-Policy-Report-Only` header built from your `SUPABASE_URL`: send it
+report-only first, tune it for what your own site loads (analytics, fonts,
+embeds), then enforce it. Once the site is running,
+`pnpm exec guardrail-doctor --app-url=https://your-site.com` checks that the live
+policy lets Guardrail's uploads and images through. A script nonce, if you use
+one, is set by your site (Next.js does it from a proxy); Guardrail doesn't need it.
 
 ## Known limitations
 
@@ -748,4 +879,4 @@ Run `pnpm exec guardrail-doctor --production` to check everything below.
 - `withGuardrail` reads cookies in the root layout, which opts routes into
   dynamic rendering. See the repo README for the plan.
 - Saving revalidates the entire layout tree rather than the affected route.
-- No drafts, revisions, or scheduled publishing. Saves are live.
+- No drafts or scheduled publishing. Saves are live; an editor can step back one version (see "Reverting a change"), but there is no full revision browser.

package/dist/adapters/supabase/db.js

@@ -8,6 +8,9 @@ function toOverrideRow(row) {
     value: typeof row.value === "string" ? JSON.parse(row.value) : row.value
   };
 }
+function isMissingFunction(error) {
+  return error.code === "PGRST202" || error.code === "42883" || /could not find the function/i.test(error.message ?? "");
+}
 function supabaseDB(creds) {
   assertCredentials(creds);
   return {
@@ -45,6 +48,36 @@ function supabaseDB(creds) {
       );
       return error ? { success: false, error: error.message } : { success: true };
     },
+    // Reverting runs in the database (gr_revert_content / gr_revert_info) so a
+    // step back is one atomic move, and the editor's own access rules apply.
+    async getRevertInfo(pathKey, siteId) {
+      const client = await sessionClient(creds);
+      const { data, error } = await client.schema(GR_SCHEMA).rpc("gr_revert_info", { p_site: siteId, p_key: pathKey });
+      if (error) {
+        if (!isMissingFunction(error)) {
+          console.error("Guardrail (Supabase): gr_revert_info failed", error.message);
+        }
+        return { kind: "none" };
+      }
+      const info = data;
+      return info && ["previous", "default", "none"].includes(info.kind) ? info : { kind: "none" };
+    },
+    async revertOverride(pathKey, siteId) {
+      const client = await sessionClient(creds);
+      const { data, error } = await client.schema(GR_SCHEMA).rpc("gr_revert_content", { p_site: siteId, p_key: pathKey });
+      if (error) {
+        return {
+          success: false,
+          error: isMissingFunction(error) ? "Reverting needs the latest database migration \u2014 run `pnpm exec guardrail-init-db --push`." : error.code === "42501" ? "You don't have permission to revert this." : error.message
+        };
+      }
+      const result = data;
+      if (result?.action === "restored" && result.value) {
+        const value = typeof result.value === "string" ? JSON.parse(result.value) : result.value;
+        return { success: true, action: "restored", value };
+      }
+      return { success: true, action: result?.action === "reset" ? "reset" : "none" };
+    },
     async deleteOverrides(pathKeyPrefix, siteId) {
       const client = await sessionClient(creds);
       const { error } = await client.schema(GR_SCHEMA).from(GR_TABLE).delete().eq("site_id", siteId).like("path_key", `${pathKeyPrefix}%`);

package/dist/adapters/supabase/db.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/adapters/supabase/db.ts"],"sourcesContent":["import { anonClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport { GR_SCHEMA, GR_TABLE } from \"../../core/defs\";\nimport type { GRDBAdapter, GRStorageRow } from \"../../core/adapter-types\";\nimport type { OverrideRow, OverrideValue } from \"../../core/types\";\n\n/** Shape as stored in Postgres. Column naming stops at this boundary. */\ninterface ContentRow {\n  id: string;\n  path_key: string;\n  value: OverrideValue | string;\n}\n\nfunction toOverrideRow(row: ContentRow): OverrideRow {\n  return {\n    id: row.id,\n    pathKey: row.path_key,\n    // Some drivers hand back jsonb columns as strings.\n    value:\n      typeof row.value === \"string\"\n        ? (JSON.parse(row.value) as OverrideValue)\n        : row.value,\n  };\n}\n\nexport function supabaseDB(creds: SupabaseCredentials): GRDBAdapter {\n  assertCredentials(creds);\n\n  return {\n    async getOverrides(pathKeys, siteId) {\n      if (pathKeys.length === 0) return [];\n\n      // Anon client keeps the read path cookie-free so routes stay static.\n      const { data, error } = await anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        .in(\"path_key\", pathKeys);\n\n      if (error) {\n        console.error(\"Guardrail (Supabase): read failed\", error.message);\n        return [];\n      }\n      return ((data ?? []) as ContentRow[]).map(toOverrideRow);\n    },\n\n    async listOverrides(siteId, { prefix, limit }) {\n      let query = anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        // Ordered so that truncation, when it happens, is deterministic.\n        .order(\"path_key\")\n        // One past the ceiling, purely to learn whether anything was cut off.\n        .limit(limit + 1);\n\n      if (prefix?.length) {\n        // Quoted so a prefix containing PostgREST's own separators (comma,\n        // parens) can't be read as filter syntax.\n        const quote = (p: string) => `\"${p.replace(/[\"\\\\]/g, \"\\\\$&\")}\"`;\n        query = query.or(prefix.map((p) => `path_key.like.${quote(`${p}*`)}`).join(\",\"));\n      }\n\n      const { data, error } = await query;\n      // Thrown, not swallowed to []: an empty list here would read as \"this\n      // site has no content\" and short-circuit every field's own lookup.\n      if (error) throw new Error(error.message);\n\n      const rows = ((data ?? []) as ContentRow[]).map(toOverrideRow);\n      return { rows: rows.slice(0, limit), truncated: rows.length > limit };\n    },\n\n    async setOverride(row: GRStorageRow) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .upsert(\n          {\n            path_key: row.pathKey,\n            site_id: row.siteId,\n            type: row.type,\n            value: row.value,\n            updated_at: new Date().toISOString(),\n          },\n          { onConflict: \"path_key,site_id\" },\n        );\n      return error\n        ? { success: false, error: error.message }\n        : { success: true };\n    },\n\n    async deleteOverrides(pathKeyPrefix: string, siteId: string) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .delete()\n        .eq(\"site_id\", siteId)\n        .like(\"path_key\", `${pathKeyPrefix}%`);\n      if (error) {\n        console.error(\"Guardrail (Supabase): deleteOverrides failed\", error.message);\n      }\n    },\n  };\n}\n"],"mappings":"AAAA,SAAS,YAAY,mBAAmB,qBAAqB;AAE7D,SAAS,WAAW,gBAAgB;AAWpC,SAAS,cAAc,KAA8B;AACnD,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,SAAS,IAAI;AAAA;AAAA,IAEb,OACE,OAAO,IAAI,UAAU,WAChB,KAAK,MAAM,IAAI,KAAK,IACrB,IAAI;AAAA,EACZ;AACF;AAEO,SAAS,WAAW,OAAyC;AAClE,oBAAkB,KAAK;AAEvB,SAAO;AAAA,IACL,MAAM,aAAa,UAAU,QAAQ;AACnC,UAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAGnC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,WAAW,KAAK,EAC3C,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EACpB,GAAG,YAAY,QAAQ;AAE1B,UAAI,OAAO;AACT,gBAAQ,MAAM,qCAAqC,MAAM,OAAO;AAChE,eAAO,CAAC;AAAA,MACV;AACA,cAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAAA,IACzD;AAAA,IAEA,MAAM,cAAc,QAAQ,EAAE,QAAQ,MAAM,GAAG;AAC7C,UAAI,QAAQ,WAAW,KAAK,EACzB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EAEpB,MAAM,UAAU,EAEhB,MAAM,QAAQ,CAAC;AAElB,UAAI,QAAQ,QAAQ;AAGlB,cAAM,QAAQ,CAAC,MAAc,IAAI,EAAE,QAAQ,UAAU,MAAM,CAAC;AAC5D,gBAAQ,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,iBAAiB,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,MACjF;AAEA,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM;AAG9B,UAAI,MAAO,OAAM,IAAI,MAAM,MAAM,OAAO;AAExC,YAAM,QAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAC7D,aAAO,EAAE,MAAM,KAAK,MAAM,GAAG,KAAK,GAAG,WAAW,KAAK,SAAS,MAAM;AAAA,IACtE;AAAA,IAEA,MAAM,YAAY,KAAmB;AACnC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb;AAAA,QACC;AAAA,UACE,UAAU,IAAI;AAAA,UACd,SAAS,IAAI;AAAA,UACb,MAAM,IAAI;AAAA,UACV,OAAO,IAAI;AAAA,UACX,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACrC;AAAA,QACA,EAAE,YAAY,mBAAmB;AAAA,MACnC;AACF,aAAO,QACH,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IACvC,EAAE,SAAS,KAAK;AAAA,IACtB;AAAA,IAEA,MAAM,gBAAgB,eAAuB,QAAgB;AAC3D,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,EACP,GAAG,WAAW,MAAM,EACpB,KAAK,YAAY,GAAG,aAAa,GAAG;AACvC,UAAI,OAAO;AACT,gBAAQ,MAAM,gDAAgD,MAAM,OAAO;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/adapters/supabase/db.ts"],"sourcesContent":["import { anonClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport { GR_SCHEMA, GR_TABLE } from \"../../core/defs\";\nimport type { GRDBAdapter, GRRevertInfo, GRRevertResult, GRStorageRow } from \"../../core/adapter-types\";\nimport type { OverrideRow, OverrideValue } from \"../../core/types\";\n\n/** Shape as stored in Postgres. Column naming stops at this boundary. */\ninterface ContentRow {\n  id: string;\n  path_key: string;\n  value: OverrideValue | string;\n}\n\nfunction toOverrideRow(row: ContentRow): OverrideRow {\n  return {\n    id: row.id,\n    pathKey: row.path_key,\n    // Some drivers hand back jsonb columns as strings.\n    value:\n      typeof row.value === \"string\"\n        ? (JSON.parse(row.value) as OverrideValue)\n        : row.value,\n  };\n}\n\n/** PostgREST's \"no such function\" (PGRST202) or Postgres' own (42883): the migration isn't applied. */\nfunction isMissingFunction(error: { code?: string; message?: string }): boolean {\n  return error.code === \"PGRST202\" || error.code === \"42883\" || /could not find the function/i.test(error.message ?? \"\");\n}\n\nexport function supabaseDB(creds: SupabaseCredentials): GRDBAdapter {\n  assertCredentials(creds);\n\n  return {\n    async getOverrides(pathKeys, siteId) {\n      if (pathKeys.length === 0) return [];\n\n      // Anon client keeps the read path cookie-free so routes stay static.\n      const { data, error } = await anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        .in(\"path_key\", pathKeys);\n\n      if (error) {\n        console.error(\"Guardrail (Supabase): read failed\", error.message);\n        return [];\n      }\n      return ((data ?? []) as ContentRow[]).map(toOverrideRow);\n    },\n\n    async listOverrides(siteId, { prefix, limit }) {\n      let query = anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        // Ordered so that truncation, when it happens, is deterministic.\n        .order(\"path_key\")\n        // One past the ceiling, purely to learn whether anything was cut off.\n        .limit(limit + 1);\n\n      if (prefix?.length) {\n        // Quoted so a prefix containing PostgREST's own separators (comma,\n        // parens) can't be read as filter syntax.\n        const quote = (p: string) => `\"${p.replace(/[\"\\\\]/g, \"\\\\$&\")}\"`;\n        query = query.or(prefix.map((p) => `path_key.like.${quote(`${p}*`)}`).join(\",\"));\n      }\n\n      const { data, error } = await query;\n      // Thrown, not swallowed to []: an empty list here would read as \"this\n      // site has no content\" and short-circuit every field's own lookup.\n      if (error) throw new Error(error.message);\n\n      const rows = ((data ?? []) as ContentRow[]).map(toOverrideRow);\n      return { rows: rows.slice(0, limit), truncated: rows.length > limit };\n    },\n\n    async setOverride(row: GRStorageRow) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .upsert(\n          {\n            path_key: row.pathKey,\n            site_id: row.siteId,\n            type: row.type,\n            value: row.value,\n            updated_at: new Date().toISOString(),\n          },\n          { onConflict: \"path_key,site_id\" },\n        );\n      return error\n        ? { success: false, error: error.message }\n        : { success: true };\n    },\n\n    // Reverting runs in the database (gr_revert_content / gr_revert_info) so a\n    // step back is one atomic move, and the editor's own access rules apply.\n    async getRevertInfo(pathKey: string, siteId: string): Promise<GRRevertInfo> {\n      const client = await sessionClient(creds);\n      const { data, error } = await client\n        .schema(GR_SCHEMA)\n        .rpc(\"gr_revert_info\", { p_site: siteId, p_key: pathKey });\n      if (error) {\n        // Not migrated yet: no history to offer, so just don't offer one.\n        if (!isMissingFunction(error)) {\n          console.error(\"Guardrail (Supabase): gr_revert_info failed\", error.message);\n        }\n        return { kind: \"none\" };\n      }\n      const info = data as GRRevertInfo | null;\n      return info && [\"previous\", \"default\", \"none\"].includes(info.kind) ? info : { kind: \"none\" };\n    },\n\n    async revertOverride(pathKey: string, siteId: string): Promise<GRRevertResult> {\n      const client = await sessionClient(creds);\n      const { data, error } = await client\n        .schema(GR_SCHEMA)\n        .rpc(\"gr_revert_content\", { p_site: siteId, p_key: pathKey });\n      if (error) {\n        return {\n          success: false,\n          error: isMissingFunction(error)\n            ? \"Reverting needs the latest database migration — run `pnpm exec guardrail-init-db --push`.\"\n            : error.code === \"42501\"\n              ? \"You don't have permission to revert this.\"\n              : error.message,\n        };\n      }\n      const result = data as { action?: string; value?: OverrideValue | string } | null;\n      if (result?.action === \"restored\" && result.value) {\n        const value = typeof result.value === \"string\" ? (JSON.parse(result.value) as OverrideValue) : result.value;\n        return { success: true, action: \"restored\", value };\n      }\n      return { success: true, action: result?.action === \"reset\" ? \"reset\" : \"none\" };\n    },\n\n    async deleteOverrides(pathKeyPrefix: string, siteId: string) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .delete()\n        .eq(\"site_id\", siteId)\n        .like(\"path_key\", `${pathKeyPrefix}%`);\n      if (error) {\n        console.error(\"Guardrail (Supabase): deleteOverrides failed\", error.message);\n      }\n    },\n  };\n}\n"],"mappings":"AAAA,SAAS,YAAY,mBAAmB,qBAAqB;AAE7D,SAAS,WAAW,gBAAgB;AAWpC,SAAS,cAAc,KAA8B;AACnD,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,SAAS,IAAI;AAAA;AAAA,IAEb,OACE,OAAO,IAAI,UAAU,WAChB,KAAK,MAAM,IAAI,KAAK,IACrB,IAAI;AAAA,EACZ;AACF;AAGA,SAAS,kBAAkB,OAAqD;AAC9E,SAAO,MAAM,SAAS,cAAc,MAAM,SAAS,WAAW,+BAA+B,KAAK,MAAM,WAAW,EAAE;AACvH;AAEO,SAAS,WAAW,OAAyC;AAClE,oBAAkB,KAAK;AAEvB,SAAO;AAAA,IACL,MAAM,aAAa,UAAU,QAAQ;AACnC,UAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAGnC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,WAAW,KAAK,EAC3C,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EACpB,GAAG,YAAY,QAAQ;AAE1B,UAAI,OAAO;AACT,gBAAQ,MAAM,qCAAqC,MAAM,OAAO;AAChE,eAAO,CAAC;AAAA,MACV;AACA,cAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAAA,IACzD;AAAA,IAEA,MAAM,cAAc,QAAQ,EAAE,QAAQ,MAAM,GAAG;AAC7C,UAAI,QAAQ,WAAW,KAAK,EACzB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EAEpB,MAAM,UAAU,EAEhB,MAAM,QAAQ,CAAC;AAElB,UAAI,QAAQ,QAAQ;AAGlB,cAAM,QAAQ,CAAC,MAAc,IAAI,EAAE,QAAQ,UAAU,MAAM,CAAC;AAC5D,gBAAQ,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,iBAAiB,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,MACjF;AAEA,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM;AAG9B,UAAI,MAAO,OAAM,IAAI,MAAM,MAAM,OAAO;AAExC,YAAM,QAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAC7D,aAAO,EAAE,MAAM,KAAK,MAAM,GAAG,KAAK,GAAG,WAAW,KAAK,SAAS,MAAM;AAAA,IACtE;AAAA,IAEA,MAAM,YAAY,KAAmB;AACnC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb;AAAA,QACC;AAAA,UACE,UAAU,IAAI;AAAA,UACd,SAAS,IAAI;AAAA,UACb,MAAM,IAAI;AAAA,UACV,OAAO,IAAI;AAAA,UACX,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACrC;AAAA,QACA,EAAE,YAAY,mBAAmB;AAAA,MACnC;AACF,aAAO,QACH,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IACvC,EAAE,SAAS,KAAK;AAAA,IACtB;AAAA;AAAA;AAAA,IAIA,MAAM,cAAc,SAAiB,QAAuC;AAC1E,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAC3B,OAAO,SAAS,EAChB,IAAI,kBAAkB,EAAE,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AAC3D,UAAI,OAAO;AAET,YAAI,CAAC,kBAAkB,KAAK,GAAG;AAC7B,kBAAQ,MAAM,+CAA+C,MAAM,OAAO;AAAA,QAC5E;AACA,eAAO,EAAE,MAAM,OAAO;AAAA,MACxB;AACA,YAAM,OAAO;AACb,aAAO,QAAQ,CAAC,YAAY,WAAW,MAAM,EAAE,SAAS,KAAK,IAAI,IAAI,OAAO,EAAE,MAAM,OAAO;AAAA,IAC7F;AAAA,IAEA,MAAM,eAAe,SAAiB,QAAyC;AAC7E,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAC3B,OAAO,SAAS,EAChB,IAAI,qBAAqB,EAAE,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AAC9D,UAAI,OAAO;AACT,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO,kBAAkB,KAAK,IAC1B,mGACA,MAAM,SAAS,UACb,8CACA,MAAM;AAAA,QACd;AAAA,MACF;AACA,YAAM,SAAS;AACf,UAAI,QAAQ,WAAW,cAAc,OAAO,OAAO;AACjD,cAAM,QAAQ,OAAO,OAAO,UAAU,WAAY,KAAK,MAAM,OAAO,KAAK,IAAsB,OAAO;AACtG,eAAO,EAAE,SAAS,MAAM,QAAQ,YAAY,MAAM;AAAA,MACpD;AACA,aAAO,EAAE,SAAS,MAAM,QAAQ,QAAQ,WAAW,UAAU,UAAU,OAAO;AAAA,IAChF;AAAA,IAEA,MAAM,gBAAgB,eAAuB,QAAgB;AAC3D,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,EACP,GAAG,WAAW,MAAM,EACpB,KAAK,YAAY,GAAG,aAAa,GAAG;AACvC,UAAI,OAAO;AACT,gBAAQ,MAAM,gDAAgD,MAAM,OAAO;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/cli/doctor.js

@@ -14,6 +14,7 @@ import { createRequire } from "node:module";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { GR_SCHEMA, GR_MEMBERS_TABLE } from "../core/defs.js";
+import { cspString, guardrailCspDirectives } from "../core/csp.js";
 const NEXT_MIN_PATCHED = {
   15: [15, 5, 28],
   16: [16, 4, 1]
@@ -66,6 +67,9 @@ Options:
                      versions of next, @supabase/* and @guard-rail/core are
                      checked against its published security advisories (only
                      package names and versions are sent, as \`pnpm audit\` does).
+  --csp              Print a starter Content-Security-Policy-Report-Only header
+                     for this site (built from SUPABASE_URL) and exit. Add it
+                     report-only first, watch the reports, then enforce.
   --production       Treat production-only requirements (like
                      GUARDRAIL_SITE_URL) as failures rather than warnings.
   --strict           Exit non-zero on warnings too.
@@ -101,7 +105,7 @@ function parseFlags(argv) {
       unknown.push(arg);
     }
   }
-  const known = /* @__PURE__ */ new Set(["fix", "push", "e2e", "yes", "production", "strict", "json", "offline", "help", "h"]);
+  const known = /* @__PURE__ */ new Set(["fix", "push", "e2e", "yes", "production", "strict", "json", "offline", "csp", "help", "h"]);
   for (const f of flags) if (!known.has(f)) unknown.push(`--${f}`);
   for (const k of Object.keys(values)) if (k !== "app-url") unknown.push(`--${k}`);
   return { flags, values, unknown };
@@ -541,16 +545,19 @@ async function checkDatabase(ctx, sb) {
   }
   const admin = sb.createClient(ctx.url, ctx.serviceKey, { auth: { persistSession: false, autoRefreshToken: false } });
   const gr = () => admin.schema(GR_SCHEMA);
-  for (const table of [GR_MEMBERS_TABLE, "gr_content", "gr_repeater_items", "gr_rate_limits"]) {
-    const { error: error2 } = await gr().from(table).select("*", { head: true, count: "exact" }).limit(1);
+  for (const table of [GR_MEMBERS_TABLE, "gr_content", "gr_repeater_items", "gr_rate_limits", "gr_content_history"]) {
+    const { error: error2 } = await gr().from(table).select("*").limit(1);
     if (!error2) pass(`Table ${table}`);
     else if (table === "gr_rate_limits") warn("Table gr_rate_limits is missing", "Rate limits are counted in memory until the migration is applied.", "Run: pnpm exec guardrail-init-db --push");
+    else if (table === "gr_content_history") warn("Table gr_content_history is missing", "Editors won't be offered a revert button until the migration is applied.", "Run: pnpm exec guardrail-init-db --push");
     else fail(`Table ${table} isn't readable`, error2.message, "Run: pnpm exec guardrail-init-db --push");
   }
   const probes = [
     ["gr_confirmed_email", {}, "Confirmed-email identity check"],
     ["gr_claim_invite", { target_site: "doctor-probe" }, "Invite-claim function"],
-    ["gr_ensure_bucket", { target_bucket: "gr-doctor-probe" }, "Media bucket function"]
+    ["gr_ensure_bucket", { target_bucket: "gr-doctor-probe" }, "Media bucket function"],
+    ["gr_revert_content", { p_site: "doctor-probe", p_key: "doctor.probe" }, "Revert function"],
+    ["gr_revert_info", { p_site: "doctor-probe", p_key: "doctor.probe" }, "Revert-info function"]
   ];
   for (const [fn, args, label] of probes) {
     const { error: error2 } = await gr().rpc(fn, args);
@@ -575,7 +582,71 @@ async function checkDatabase(ctx, sb) {
   info("Admin guard (can't delete the last admin)", "Verified by --e2e; it's a trigger, which can't be probed read-only.");
   return true;
 }
-async function checkLiveSite(appUrl) {
+function parseCsp(value) {
+  const out = {};
+  for (const part of value.split(";")) {
+    const [name, ...sources] = part.trim().split(/\s+/);
+    if (name) out[name.toLowerCase()] = sources;
+  }
+  return out;
+}
+function effectiveSources(csp, name) {
+  return csp[name] ?? csp["default-src"] ?? null;
+}
+function allowsOrigin(sources, origin) {
+  if (sources === null) return true;
+  const target = new URL(origin);
+  return sources.some((raw) => {
+    const src = raw.toLowerCase();
+    if (src === "*") return true;
+    if (src === `${target.protocol}`) return true;
+    if (src === origin.toLowerCase()) return true;
+    const wild = src.match(/^(https?:)\/\/\*\.(.+?)(?::(\d+))?$/);
+    if (wild) {
+      const [, scheme, domain, port] = wild;
+      return scheme === target.protocol && target.hostname.endsWith(`.${domain}`) && (!port || port === target.port);
+    }
+    return false;
+  });
+}
+function starterPolicy(supabaseUrl) {
+  const gr = guardrailCspDirectives(supabaseUrl ? { supabaseUrl } : {});
+  return cspString({
+    "default-src": ["'self'"],
+    "script-src": ["'self'", "'nonce-REPLACE_PER_REQUEST'", "'strict-dynamic'"],
+    "style-src": gr["style-src"],
+    "img-src": [...gr["img-src"], "data:"],
+    "connect-src": gr["connect-src"],
+    "font-src": ["'self'", "data:"],
+    "object-src": ["'none'"],
+    "base-uri": ["'self'"],
+    "form-action": ["'self'"],
+    "frame-ancestors": gr["frame-ancestors"]
+  });
+}
+function printStarterCsp(ctx) {
+  console.log(`Starter Content-Security-Policy
+
+Content-Security-Policy-Report-Only: ${starterPolicy(ctx.url)}
+
+How to use it
+  - Send it as Content-Security-Policy-Report-Only first. Browsers report what it
+    would block without blocking anything; tune it for the things your site
+    loads itself (analytics, fonts, embeds), then switch the header name to
+    Content-Security-Policy.
+  - Guardrail needs nothing beyond 'self' for styles and scripts. Its stylesheet is
+    a real file and it renders no inline scripts, so it needs no 'unsafe-inline' and no
+    nonce. The only extras are your Supabase origin in connect-src (image
+    uploads) and img-src (the media picker's thumbnails).${ctx.url ? "" : "\n    (Set SUPABASE_URL and run this again to include your Supabase origin.)"}
+  - script-src above uses a per-request nonce, which Next.js sets from a proxy
+    (see "Content Security Policy" in the Next.js docs). With only a static header
+    in next.config you can't use a nonce \u2014 use 'self' 'unsafe-inline' for scripts
+    instead, which is a weaker policy but still a useful one.
+  - guardrailCspDirectives() from @guard-rail/core returns Guardrail's directives
+    if you build the header in code.
+`);
+}
+async function checkLiveSite(appUrl, ctx) {
   group("Live site");
   let res;
   try {
@@ -606,6 +677,69 @@ async function checkLiveSite(appUrl) {
   const setCookie = typeof h.getSetCookie === "function" ? h.getSetCookie() : [];
   const session = setCookie.filter((c) => /^sb-.*-auth-token/i.test(c));
   if (session.length) fail("A session cookie was set for an anonymous request", session.map((c) => c.split("=")[0]).join(", "));
+  if (res.status === 200) {
+    const html = await res.text().catch(() => "");
+    const MARKER = /--gr-bg\b|\.gr-banner\b/;
+    const inline = [...html.matchAll(/<style[^>]*>([\s\S]*?)<\/style>/gi)].map((m) => m[1]).join("\n");
+    let found = MARKER.test(inline);
+    const hrefs = [...html.matchAll(/<link\b[^>]*rel=["']stylesheet["'][^>]*>/gi)].map((m) => m[0].match(/href=["']([^"']+)["']/i)?.[1]).filter((x) => Boolean(x)).slice(0, 8);
+    for (const href of hrefs) {
+      if (found) break;
+      try {
+        const css = await fetch(new URL(href, appUrl), { signal: AbortSignal.timeout(8e3) });
+        if (css.ok && MARKER.test(await css.text())) found = true;
+      } catch {
+      }
+    }
+    if (found) pass("Guardrail's stylesheet is on the page");
+    else if (hrefs.length === 0 && !/<style/i.test(html)) skip("Guardrail's stylesheet", "The page has no stylesheets to inspect.");
+    else {
+      warn(
+        "Guardrail's stylesheet isn't on the page",
+        "Its editing chrome would render unstyled. The package imports its own CSS, which your bundler may not be picking up.",
+        'Import it once in your root layout: import "@guard-rail/core/styles.css";'
+      );
+    }
+  }
+  const enforced = h.get("content-security-policy");
+  const reportOnly = h.get("content-security-policy-report-only");
+  const policy = enforced ?? reportOnly;
+  if (!policy) {
+    warn(
+      "No Content-Security-Policy",
+      "Nothing limits where scripts and styles can load from, so an injected script would run.",
+      "Run: pnpm exec guardrail-doctor --csp   (prints a starter report-only policy)"
+    );
+    return;
+  }
+  const parsed = parseCsp(policy);
+  const label = enforced ? "" : " (report-only)";
+  if (!parsed["default-src"] && !parsed["script-src"]) {
+    info(`Content-Security-Policy only sets ${Object.keys(parsed).join(", ") || "nothing"}`, "It doesn't restrict scripts. Run: pnpm exec guardrail-doctor --csp for a fuller starter.");
+    return;
+  }
+  const style = effectiveSources(parsed, "style-src");
+  if (style && style.map((x) => x.toLowerCase()).includes("'unsafe-inline'")) {
+    info(`style-src allows 'unsafe-inline'${label}`, "Guardrail no longer needs it \u2014 its chrome is a stylesheet. Remove it unless something else on the site does.");
+  } else {
+    pass(`Policy${label} doesn't need 'unsafe-inline' for Guardrail's styles`);
+  }
+  if (ctx.url) {
+    let supabase;
+    try {
+      supabase = new URL(ctx.url).origin;
+    } catch {
+    }
+    if (supabase && supabase !== new URL(appUrl).origin) {
+      for (const [directive, why] of [
+        ["connect-src", "image uploads go straight from the browser to Supabase storage"],
+        ["img-src", "uploaded images and the media picker's thumbnails load from Supabase storage"]
+      ]) {
+        if (allowsOrigin(effectiveSources(parsed, directive), supabase)) pass(`${directive}${label} allows ${supabase}`);
+        else warn(`${directive}${label} blocks ${supabase}`, `Needed because ${why}.`, `Add ${supabase} to ${directive}.`);
+      }
+    }
+  }
 }
 const TINY_PNG = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==",
@@ -704,6 +838,37 @@ async function runE2E(ctx, sb) {
       value: { type: "text", text: "nope" }
     });
     expect(Boolean(anonWrite.error), "Visitors can't write content", anonWrite.error ? void 0 : "An unauthenticated write was allowed.");
+    const histCount = async () => {
+      const r = await gr(admin).from("gr_content_history").select("id", { count: "exact", head: true }).eq("site_id", siteId).eq("path_key", "doctor.check");
+      return r.error ? -1 : r.count ?? 0;
+    };
+    const setText = (text) => gr(user).from("gr_content").update({ value: { type: "text", text }, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("site_id", siteId).eq("path_key", "doctor.check");
+    const current = async () => {
+      const r = await gr(user).from("gr_content").select("value").eq("site_id", siteId).eq("path_key", "doctor.check").maybeSingle();
+      return r.data?.value?.text ?? null;
+    };
+    const revertRpc = async (site = siteId) => {
+      const r = await gr(user).rpc("gr_revert_content", { p_site: site, p_key: "doctor.check" });
+      return { error: r.error, data: r.data };
+    };
+    await setText("v1");
+    await setText("v1");
+    const afterTwo = await histCount();
+    expect(afterTwo === 1, "A save keeps the old value in history, and re-saving the same value doesn't", `Expected 1 history entry, found ${afterTwo}.`, "Apply the latest migrations: pnpm exec guardrail-init-db --push");
+    const info1 = await gr(user).rpc("gr_revert_info", { p_site: siteId, p_key: "doctor.check" });
+    expect(info1.data?.kind === "previous", "The editor is told a previous version exists", info1.error?.message);
+    const peek = await gr(anon).from("gr_content_history").select("id").eq("site_id", siteId);
+    expect(Boolean(peek.error) || (peek.data?.length ?? 0) === 0, "Visitors can't read content history", peek.error ? void 0 : "An unauthenticated read returned history rows.");
+    const foreign = await revertRpc(otherSite);
+    expect(Boolean(foreign.error), "An editor can't revert another site's content", foreign.error ? void 0 : "The revert was allowed.");
+    const r1 = await revertRpc();
+    expect(!r1.error && r1.data?.action === "restored" && await current() === "doctor" && await histCount() === 0, "Revert steps back one version", r1.error?.message ?? `Got ${JSON.stringify(r1.data)}.`, "Apply the latest migrations: pnpm exec guardrail-init-db --push");
+    const r2 = await revertRpc();
+    expect(!r2.error && r2.data?.action === "reset" && await current() === null, "Revert with nothing earlier returns the field to its default", r2.error?.message ?? `Got ${JSON.stringify(r2.data)}.`);
+    await gr(user).from("gr_content").insert({ site_id: siteId, path_key: "doctor.check", type: "text", value: { type: "text", text: "n0" } });
+    for (let i = 1; i <= 22; i++) await setText(`n${i}`);
+    const kept = await histCount();
+    expect(kept === 20, "History keeps the newest 20 versions of a field", `Expected 20, found ${kept}.`, "Apply the latest migrations: pnpm exec guardrail-init-db --push");
     const demote = await gr(user).from(GR_MEMBERS_TABLE).update({ role: "editor" }).eq("site_id", siteId).eq("email", email);
     expect(
       Boolean(demote.error),
@@ -839,6 +1004,10 @@ ${USAGE}`);
     anonKey: env.SUPABASE_ANON_KEY,
     serviceKey: env.SUPABASE_SERVICE_ROLE_KEY ?? env.SERVICE_KEY
   };
+  if (flags.has("csp")) {
+    printStarterCsp(ctx);
+    return 0;
+  }
   const json = flags.has("json");
   if (!json) console.log("Guardrail doctor");
   if (flags.has("fix")) {
@@ -876,7 +1045,7 @@ ${paint(1, "Fixes")}`);
   checkFiles(ctx);
   const sb = await loadSupabase();
   const dbReachable = await checkDatabase(ctx, sb);
-  if (values["app-url"]) await checkLiveSite(values["app-url"]);
+  if (values["app-url"]) await checkLiveSite(values["app-url"], ctx);
   if (flags.has("e2e")) {
     group("End-to-end");
     if (!dbReachable || !sb) {