@guard-rail/core 0.11.0 → 0.13.0

package/README.md

@@ -435,18 +435,106 @@ scratch. A visual page builder (Puck, say) is a better fit for that and can
 sit alongside `<GRepeater>` later — it would decide composition, while
 `<GRail>` still owns each block's leaf content.
 
+## Reverting a change
+
+Every editor popup has a circular-arrow **revert** button next to save and close.
+It steps one version back:
+
+- If the field was edited more than once, it restores the **previous saved value**
+  — the button reads "Revert to the version from Oct 28".
+- If there's nothing earlier, it removes the saved value so the field shows the
+  **default written in the page** — the button reads "Reset to default".
+- If the field has nothing saved, the button isn't shown.
+
+The field updates in place, and everyone else sees the change straight away. There's
+no confirmation step; the label says what it will do.
+
+Behind it, each save that changes a field's value moves the old value into a
+separate `gr_content_history` table, which only editors of the site can read (the
+public `gr_content` table still holds just the current value). Saving the same value
+again records nothing. History is kept for the newest **20 versions of each field**
+and for **90 days**, whichever is less, and is cleaned up as part of saving — no
+scheduled job. Removing a field (a deleted repeater item, say) removes its history.
+
+Things to know:
+
+- **Images:** reverting restores the earlier reference. Uploaded files aren't
+  deleted, so they stay in the media picker for reuse.
+- **Repeaters:** a field inside an item reverts like any other. Adding, removing and
+  reordering items isn't part of history.
+- **Existing content has no history yet.** Revert becomes available after a field's
+  next edit.
+- **It needs the `content_history` migration.** Without it, the button just doesn't
+  appear. `pnpm exec guardrail-init-db --push`, or `guardrail-doctor --fix --push`,
+  applies it.
+
+Building your own editing UI? `getRevertInfo(id)` reports what a revert would do
+(`{ kind: "previous" | "default" | "none", at }`) and `revertField(id)` does it. Both
+check the caller is an editor or admin.
+
+## Page settings and metadata
+
+Editors can set each page's search and sharing metadata without touching code. The
+**gear** in the toolbar, next to the people icon, opens a **Page settings** drawer for
+the page they're on, with a **title**, a **description**, a **social image** (with
+alt text) and a **hide this page from search engines** switch. It looks like the
+Team drawer, with a revert arrow on each field.
+
+In the page, give `guardrailMetadata()` the page's path and your own defaults:
+
+```tsx
+// app/about/page.tsx
+import { guardrailMetadata } from "@guard-rail/core";
+
+export async function generateMetadata() {
+  return guardrailMetadata("/about", {
+    title: "About us",
+    description: "Who we are.",
+    image: "https://example.com/about.png", // optional
+  });
+}
+```
+
+Whatever an editor saved wins; your values are the fallback, and clearing a field in
+the drawer goes back to them. For a dynamic route, pass the real path:
+`` guardrailMetadata(`/products/${slug}`, { … }) ``. It returns the title, description,
+Open Graph and Twitter card tags, plus a robots tag when the page is hidden from search
+engines. With nothing saved and no defaults given, it returns nothing, so the page
+inherits your layout's metadata. All four settings are read in one query.
+
+Things to know:
+
+- **The path has to match.** The drawer keys values by the path the browser shows, and
+  `guardrailMetadata()` by the path you pass. Query strings, hashes and trailing slashes
+  are ignored; a rewrite, locale prefix or `basePath` that changes the visible path will
+  need the same path passed in.
+- **Only pages that call `guardrailMetadata()` pick the settings up.** The drawer says so.
+- **Next replaces a layout's `openGraph` and `twitter` objects rather than merging
+  them**, so if your layout sets something there (a `siteName`, say) and you want to keep
+  it, merge it into what you return.
+- **Social images need an absolute URL.** Uploaded images already have one. A relative
+  path needs `metadataBase` set in your layout.
+- **Versioned like everything else.** Settings are ordinary content rows (keyed
+  `seo./about.title` and so on), so each one gets the history and one-step revert
+  described above. Clearing a field is saved as a version too, so it can be reverted.
+- **No new migration.** They're kept out of the content preloaded into Client Components,
+  so a site with many pages doesn't crowd out its real content.
+
 ## Custom editing UI
 
-`<GRail>` edits what's on the page. Some fields have nothing to click — an SEO
-title, a meta description, an og:image — and some data isn't copy at all, like
-stock or price. For those, build a small drawer of your own and keep the
-authorization in Guardrail's hands:
+`<GRail>` edits what's on the page. Some fields have nothing to click — and
+some data isn't copy at all, like stock or price. (A page's own SEO title,
+description and og:image have a built-in drawer: see "Page settings and metadata".)
+For anything else, build a small drawer of your own and keep the authorization in
+Guardrail's hands:
 
 - **`getFieldValue(id)`** reads any field (server-side).
 - **`setFieldValue(id, value)`** writes one. A string is shorthand for a text
   field; pass `{ type: "image", src, alt }` etc. for the others. It checks the
   caller is an editor or admin itself, and writes the same row a `<GRail>` with
   that id would, so the two stay interchangeable.
+- **`getRevertInfo(id)` / `revertField(id)`** report and perform a one-step revert
+  (see "Reverting a change").
 - **`isEditor()` / `isAdmin()`** are the role checks for your *own* Server
   Actions. `isEditor()` is true for editors and admins; `isAdmin()` only for
   admins (team management).
@@ -624,6 +712,13 @@ work inside Client Components (see above): one round trip returning the site's r
 and whether the list was cut off at `limit`. An adapter without it still works
 fully for Server Components — client-rendered fields just show their JSX fallback.
 
+`getRevertInfo(pathKey, siteId)` and `revertOverride(pathKey, siteId)` are optional and
+go together: they back the revert button (see "Reverting a change"). `getRevertInfo`
+returns `{ kind: "previous" | "default" | "none", at? }`; `revertOverride` restores the
+previous saved value (returning it) or removes the saved value, and reports which.
+An adapter without them simply never shows the button — keeping the history is up to
+your backend.
+
 `getOverrides(pathKeys, siteId)` is batched by design — it receives every key a
 render pass needs, already deduplicated. Adapters map their own storage naming
 at this boundary; core speaks `pathKey` / `siteId` only.
@@ -660,14 +755,14 @@ By default it only reads. It checks:
   `supabase/migrations/`, that `next.config` sets anti-framing headers, and that
   the root layout uses `withGuardrail()`.
 - **Database:** that the `guardrail` schema is exposed, the tables and functions
-  exist, rate limiting works, and what your project's sign-up settings are
+  exist (including the revert history), rate limiting works, and what your project's sign-up settings are
   (whether **Confirm email** is on).
 
 | Flag | What it adds |
 |---|---|
 | `--fix` | Repairs what can be repaired in local files: copies missing migrations, adds a `GUARDRAIL_SITE_URL` note to `.env.example` / `.env.local`, adds baseline security headers to `next.config`. It never changes secrets or Supabase dashboard settings, and re-running it is safe. Add `--push` to also run `supabase db push`. |
 | `--app-url=http://localhost:3000` | Also checks the response headers of a running copy of your site, including that Guardrail's stylesheet reached the page and that its Content-Security-Policy lets Guardrail's uploads and images through. |
-| `--e2e` | Runs an end-to-end suite against the database. It creates a throwaway user, a few rows and a test image, then exercises sign-in, claiming an invitation, row-level security (an editor can write their own site and nobody else's; visitors can read but not write), the last-admin guard, rate limiting and image uploads, and deletes everything it made. It asks before touching a database that isn't local (`--yes` skips the question), and needs the service-role key. |
+| `--e2e` | Runs an end-to-end suite against the database. It creates a throwaway user, a few rows and a test image, then exercises sign-in, claiming an invitation, row-level security (an editor can write their own site and nobody else's; visitors can read but not write), reverting and the history limits, the last-admin guard, rate limiting and image uploads, and deletes everything it made. It asks before touching a database that isn't local (`--yes` skips the question), and needs the service-role key. |
 | `--csp` | Prints a starter `Content-Security-Policy-Report-Only` header built from your `SUPABASE_URL` and exits. |
 | `--offline` | Skips the advisory lookup (the only network call besides your own Supabase project). Package names and versions are what's sent otherwise, as with `pnpm audit`; offline, Next.js is checked against a built-in list that may be out of date. |
 | `--production` | Treats production-only requirements as failures instead of warnings. |
@@ -833,4 +928,4 @@ one, is set by your site (Next.js does it from a proxy); Guardrail doesn't need
 - `withGuardrail` reads cookies in the root layout, which opts routes into
   dynamic rendering. See the repo README for the plan.
 - Saving revalidates the entire layout tree rather than the affected route.
-- No drafts, revisions, or scheduled publishing. Saves are live.
+- No drafts or scheduled publishing. Saves are live; an editor can step back one version (see "Reverting a change"), but there is no full revision browser.

package/dist/adapters/supabase/db.js

@@ -8,6 +8,9 @@ function toOverrideRow(row) {
     value: typeof row.value === "string" ? JSON.parse(row.value) : row.value
   };
 }
+function isMissingFunction(error) {
+  return error.code === "PGRST202" || error.code === "42883" || /could not find the function/i.test(error.message ?? "");
+}
 function supabaseDB(creds) {
   assertCredentials(creds);
   return {
@@ -20,12 +23,15 @@ function supabaseDB(creds) {
       }
       return (data ?? []).map(toOverrideRow);
     },
-    async listOverrides(siteId, { prefix, limit }) {
+    async listOverrides(siteId, { prefix, limit, exclude }) {
       let query = anonClient(creds).schema(GR_SCHEMA).from(GR_TABLE).select("id, path_key, value").eq("site_id", siteId).order("path_key").limit(limit + 1);
       if (prefix?.length) {
         const quote = (p) => `"${p.replace(/["\\]/g, "\\$&")}"`;
         query = query.or(prefix.map((p) => `path_key.like.${quote(`${p}*`)}`).join(","));
       }
+      for (const p of exclude ?? []) {
+        query = query.not("path_key", "like", `${p.replace(/[%_\\]/g, "\\$&")}%`);
+      }
       const { data, error } = await query;
       if (error) throw new Error(error.message);
       const rows = (data ?? []).map(toOverrideRow);
@@ -45,6 +51,36 @@ function supabaseDB(creds) {
       );
       return error ? { success: false, error: error.message } : { success: true };
     },
+    // Reverting runs in the database (gr_revert_content / gr_revert_info) so a
+    // step back is one atomic move, and the editor's own access rules apply.
+    async getRevertInfo(pathKey, siteId) {
+      const client = await sessionClient(creds);
+      const { data, error } = await client.schema(GR_SCHEMA).rpc("gr_revert_info", { p_site: siteId, p_key: pathKey });
+      if (error) {
+        if (!isMissingFunction(error)) {
+          console.error("Guardrail (Supabase): gr_revert_info failed", error.message);
+        }
+        return { kind: "none" };
+      }
+      const info = data;
+      return info && ["previous", "default", "none"].includes(info.kind) ? info : { kind: "none" };
+    },
+    async revertOverride(pathKey, siteId) {
+      const client = await sessionClient(creds);
+      const { data, error } = await client.schema(GR_SCHEMA).rpc("gr_revert_content", { p_site: siteId, p_key: pathKey });
+      if (error) {
+        return {
+          success: false,
+          error: isMissingFunction(error) ? "Reverting needs the latest database migration \u2014 run `pnpm exec guardrail-init-db --push`." : error.code === "42501" ? "You don't have permission to revert this." : error.message
+        };
+      }
+      const result = data;
+      if (result?.action === "restored" && result.value) {
+        const value = typeof result.value === "string" ? JSON.parse(result.value) : result.value;
+        return { success: true, action: "restored", value };
+      }
+      return { success: true, action: result?.action === "reset" ? "reset" : "none" };
+    },
     async deleteOverrides(pathKeyPrefix, siteId) {
       const client = await sessionClient(creds);
       const { error } = await client.schema(GR_SCHEMA).from(GR_TABLE).delete().eq("site_id", siteId).like("path_key", `${pathKeyPrefix}%`);

package/dist/adapters/supabase/db.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/adapters/supabase/db.ts"],"sourcesContent":["import { anonClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport { GR_SCHEMA, GR_TABLE } from \"../../core/defs\";\nimport type { GRDBAdapter, GRStorageRow } from \"../../core/adapter-types\";\nimport type { OverrideRow, OverrideValue } from \"../../core/types\";\n\n/** Shape as stored in Postgres. Column naming stops at this boundary. */\ninterface ContentRow {\n  id: string;\n  path_key: string;\n  value: OverrideValue | string;\n}\n\nfunction toOverrideRow(row: ContentRow): OverrideRow {\n  return {\n    id: row.id,\n    pathKey: row.path_key,\n    // Some drivers hand back jsonb columns as strings.\n    value:\n      typeof row.value === \"string\"\n        ? (JSON.parse(row.value) as OverrideValue)\n        : row.value,\n  };\n}\n\nexport function supabaseDB(creds: SupabaseCredentials): GRDBAdapter {\n  assertCredentials(creds);\n\n  return {\n    async getOverrides(pathKeys, siteId) {\n      if (pathKeys.length === 0) return [];\n\n      // Anon client keeps the read path cookie-free so routes stay static.\n      const { data, error } = await anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        .in(\"path_key\", pathKeys);\n\n      if (error) {\n        console.error(\"Guardrail (Supabase): read failed\", error.message);\n        return [];\n      }\n      return ((data ?? []) as ContentRow[]).map(toOverrideRow);\n    },\n\n    async listOverrides(siteId, { prefix, limit }) {\n      let query = anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        // Ordered so that truncation, when it happens, is deterministic.\n        .order(\"path_key\")\n        // One past the ceiling, purely to learn whether anything was cut off.\n        .limit(limit + 1);\n\n      if (prefix?.length) {\n        // Quoted so a prefix containing PostgREST's own separators (comma,\n        // parens) can't be read as filter syntax.\n        const quote = (p: string) => `\"${p.replace(/[\"\\\\]/g, \"\\\\$&\")}\"`;\n        query = query.or(prefix.map((p) => `path_key.like.${quote(`${p}*`)}`).join(\",\"));\n      }\n\n      const { data, error } = await query;\n      // Thrown, not swallowed to []: an empty list here would read as \"this\n      // site has no content\" and short-circuit every field's own lookup.\n      if (error) throw new Error(error.message);\n\n      const rows = ((data ?? []) as ContentRow[]).map(toOverrideRow);\n      return { rows: rows.slice(0, limit), truncated: rows.length > limit };\n    },\n\n    async setOverride(row: GRStorageRow) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .upsert(\n          {\n            path_key: row.pathKey,\n            site_id: row.siteId,\n            type: row.type,\n            value: row.value,\n            updated_at: new Date().toISOString(),\n          },\n          { onConflict: \"path_key,site_id\" },\n        );\n      return error\n        ? { success: false, error: error.message }\n        : { success: true };\n    },\n\n    async deleteOverrides(pathKeyPrefix: string, siteId: string) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .delete()\n        .eq(\"site_id\", siteId)\n        .like(\"path_key\", `${pathKeyPrefix}%`);\n      if (error) {\n        console.error(\"Guardrail (Supabase): deleteOverrides failed\", error.message);\n      }\n    },\n  };\n}\n"],"mappings":"AAAA,SAAS,YAAY,mBAAmB,qBAAqB;AAE7D,SAAS,WAAW,gBAAgB;AAWpC,SAAS,cAAc,KAA8B;AACnD,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,SAAS,IAAI;AAAA;AAAA,IAEb,OACE,OAAO,IAAI,UAAU,WAChB,KAAK,MAAM,IAAI,KAAK,IACrB,IAAI;AAAA,EACZ;AACF;AAEO,SAAS,WAAW,OAAyC;AAClE,oBAAkB,KAAK;AAEvB,SAAO;AAAA,IACL,MAAM,aAAa,UAAU,QAAQ;AACnC,UAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAGnC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,WAAW,KAAK,EAC3C,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EACpB,GAAG,YAAY,QAAQ;AAE1B,UAAI,OAAO;AACT,gBAAQ,MAAM,qCAAqC,MAAM,OAAO;AAChE,eAAO,CAAC;AAAA,MACV;AACA,cAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAAA,IACzD;AAAA,IAEA,MAAM,cAAc,QAAQ,EAAE,QAAQ,MAAM,GAAG;AAC7C,UAAI,QAAQ,WAAW,KAAK,EACzB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EAEpB,MAAM,UAAU,EAEhB,MAAM,QAAQ,CAAC;AAElB,UAAI,QAAQ,QAAQ;AAGlB,cAAM,QAAQ,CAAC,MAAc,IAAI,EAAE,QAAQ,UAAU,MAAM,CAAC;AAC5D,gBAAQ,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,iBAAiB,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,MACjF;AAEA,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM;AAG9B,UAAI,MAAO,OAAM,IAAI,MAAM,MAAM,OAAO;AAExC,YAAM,QAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAC7D,aAAO,EAAE,MAAM,KAAK,MAAM,GAAG,KAAK,GAAG,WAAW,KAAK,SAAS,MAAM;AAAA,IACtE;AAAA,IAEA,MAAM,YAAY,KAAmB;AACnC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb;AAAA,QACC;AAAA,UACE,UAAU,IAAI;AAAA,UACd,SAAS,IAAI;AAAA,UACb,MAAM,IAAI;AAAA,UACV,OAAO,IAAI;AAAA,UACX,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACrC;AAAA,QACA,EAAE,YAAY,mBAAmB;AAAA,MACnC;AACF,aAAO,QACH,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IACvC,EAAE,SAAS,KAAK;AAAA,IACtB;AAAA,IAEA,MAAM,gBAAgB,eAAuB,QAAgB;AAC3D,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,EACP,GAAG,WAAW,MAAM,EACpB,KAAK,YAAY,GAAG,aAAa,GAAG;AACvC,UAAI,OAAO;AACT,gBAAQ,MAAM,gDAAgD,MAAM,OAAO;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/adapters/supabase/db.ts"],"sourcesContent":["import { anonClient, assertCredentials, sessionClient } from \"./client\";\nimport type { SupabaseCredentials } from \"./client\";\nimport { GR_SCHEMA, GR_TABLE } from \"../../core/defs\";\nimport type { GRDBAdapter, GRRevertInfo, GRRevertResult, GRStorageRow } from \"../../core/adapter-types\";\nimport type { OverrideRow, OverrideValue } from \"../../core/types\";\n\n/** Shape as stored in Postgres. Column naming stops at this boundary. */\ninterface ContentRow {\n  id: string;\n  path_key: string;\n  value: OverrideValue | string;\n}\n\nfunction toOverrideRow(row: ContentRow): OverrideRow {\n  return {\n    id: row.id,\n    pathKey: row.path_key,\n    // Some drivers hand back jsonb columns as strings.\n    value:\n      typeof row.value === \"string\"\n        ? (JSON.parse(row.value) as OverrideValue)\n        : row.value,\n  };\n}\n\n/** PostgREST's \"no such function\" (PGRST202) or Postgres' own (42883): the migration isn't applied. */\nfunction isMissingFunction(error: { code?: string; message?: string }): boolean {\n  return error.code === \"PGRST202\" || error.code === \"42883\" || /could not find the function/i.test(error.message ?? \"\");\n}\n\nexport function supabaseDB(creds: SupabaseCredentials): GRDBAdapter {\n  assertCredentials(creds);\n\n  return {\n    async getOverrides(pathKeys, siteId) {\n      if (pathKeys.length === 0) return [];\n\n      // Anon client keeps the read path cookie-free so routes stay static.\n      const { data, error } = await anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        .in(\"path_key\", pathKeys);\n\n      if (error) {\n        console.error(\"Guardrail (Supabase): read failed\", error.message);\n        return [];\n      }\n      return ((data ?? []) as ContentRow[]).map(toOverrideRow);\n    },\n\n    async listOverrides(siteId, { prefix, limit, exclude }) {\n      let query = anonClient(creds)\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .select(\"id, path_key, value\")\n        .eq(\"site_id\", siteId)\n        // Ordered so that truncation, when it happens, is deterministic.\n        .order(\"path_key\")\n        // One past the ceiling, purely to learn whether anything was cut off.\n        .limit(limit + 1);\n\n      if (prefix?.length) {\n        // Quoted so a prefix containing PostgREST's own separators (comma,\n        // parens) can't be read as filter syntax.\n        const quote = (p: string) => `\"${p.replace(/[\"\\\\]/g, \"\\\\$&\")}\"`;\n        query = query.or(prefix.map((p) => `path_key.like.${quote(`${p}*`)}`).join(\",\"));\n      }\n\n      for (const p of exclude ?? []) {\n        query = query.not(\"path_key\", \"like\", `${p.replace(/[%_\\\\]/g, \"\\\\$&\")}%`);\n      }\n\n      const { data, error } = await query;\n      // Thrown, not swallowed to []: an empty list here would read as \"this\n      // site has no content\" and short-circuit every field's own lookup.\n      if (error) throw new Error(error.message);\n\n      const rows = ((data ?? []) as ContentRow[]).map(toOverrideRow);\n      return { rows: rows.slice(0, limit), truncated: rows.length > limit };\n    },\n\n    async setOverride(row: GRStorageRow) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .upsert(\n          {\n            path_key: row.pathKey,\n            site_id: row.siteId,\n            type: row.type,\n            value: row.value,\n            updated_at: new Date().toISOString(),\n          },\n          { onConflict: \"path_key,site_id\" },\n        );\n      return error\n        ? { success: false, error: error.message }\n        : { success: true };\n    },\n\n    // Reverting runs in the database (gr_revert_content / gr_revert_info) so a\n    // step back is one atomic move, and the editor's own access rules apply.\n    async getRevertInfo(pathKey: string, siteId: string): Promise<GRRevertInfo> {\n      const client = await sessionClient(creds);\n      const { data, error } = await client\n        .schema(GR_SCHEMA)\n        .rpc(\"gr_revert_info\", { p_site: siteId, p_key: pathKey });\n      if (error) {\n        // Not migrated yet: no history to offer, so just don't offer one.\n        if (!isMissingFunction(error)) {\n          console.error(\"Guardrail (Supabase): gr_revert_info failed\", error.message);\n        }\n        return { kind: \"none\" };\n      }\n      const info = data as GRRevertInfo | null;\n      return info && [\"previous\", \"default\", \"none\"].includes(info.kind) ? info : { kind: \"none\" };\n    },\n\n    async revertOverride(pathKey: string, siteId: string): Promise<GRRevertResult> {\n      const client = await sessionClient(creds);\n      const { data, error } = await client\n        .schema(GR_SCHEMA)\n        .rpc(\"gr_revert_content\", { p_site: siteId, p_key: pathKey });\n      if (error) {\n        return {\n          success: false,\n          error: isMissingFunction(error)\n            ? \"Reverting needs the latest database migration — run `pnpm exec guardrail-init-db --push`.\"\n            : error.code === \"42501\"\n              ? \"You don't have permission to revert this.\"\n              : error.message,\n        };\n      }\n      const result = data as { action?: string; value?: OverrideValue | string } | null;\n      if (result?.action === \"restored\" && result.value) {\n        const value = typeof result.value === \"string\" ? (JSON.parse(result.value) as OverrideValue) : result.value;\n        return { success: true, action: \"restored\", value };\n      }\n      return { success: true, action: result?.action === \"reset\" ? \"reset\" : \"none\" };\n    },\n\n    async deleteOverrides(pathKeyPrefix: string, siteId: string) {\n      const client = await sessionClient(creds);\n      const { error } = await client\n        .schema(GR_SCHEMA)\n        .from(GR_TABLE)\n        .delete()\n        .eq(\"site_id\", siteId)\n        .like(\"path_key\", `${pathKeyPrefix}%`);\n      if (error) {\n        console.error(\"Guardrail (Supabase): deleteOverrides failed\", error.message);\n      }\n    },\n  };\n}\n"],"mappings":"AAAA,SAAS,YAAY,mBAAmB,qBAAqB;AAE7D,SAAS,WAAW,gBAAgB;AAWpC,SAAS,cAAc,KAA8B;AACnD,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,SAAS,IAAI;AAAA;AAAA,IAEb,OACE,OAAO,IAAI,UAAU,WAChB,KAAK,MAAM,IAAI,KAAK,IACrB,IAAI;AAAA,EACZ;AACF;AAGA,SAAS,kBAAkB,OAAqD;AAC9E,SAAO,MAAM,SAAS,cAAc,MAAM,SAAS,WAAW,+BAA+B,KAAK,MAAM,WAAW,EAAE;AACvH;AAEO,SAAS,WAAW,OAAyC;AAClE,oBAAkB,KAAK;AAEvB,SAAO;AAAA,IACL,MAAM,aAAa,UAAU,QAAQ;AACnC,UAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAGnC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,WAAW,KAAK,EAC3C,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EACpB,GAAG,YAAY,QAAQ;AAE1B,UAAI,OAAO;AACT,gBAAQ,MAAM,qCAAqC,MAAM,OAAO;AAChE,eAAO,CAAC;AAAA,MACV;AACA,cAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAAA,IACzD;AAAA,IAEA,MAAM,cAAc,QAAQ,EAAE,QAAQ,OAAO,QAAQ,GAAG;AACtD,UAAI,QAAQ,WAAW,KAAK,EACzB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,qBAAqB,EAC5B,GAAG,WAAW,MAAM,EAEpB,MAAM,UAAU,EAEhB,MAAM,QAAQ,CAAC;AAElB,UAAI,QAAQ,QAAQ;AAGlB,cAAM,QAAQ,CAAC,MAAc,IAAI,EAAE,QAAQ,UAAU,MAAM,CAAC;AAC5D,gBAAQ,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,iBAAiB,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,MACjF;AAEA,iBAAW,KAAK,WAAW,CAAC,GAAG;AAC7B,gBAAQ,MAAM,IAAI,YAAY,QAAQ,GAAG,EAAE,QAAQ,WAAW,MAAM,CAAC,GAAG;AAAA,MAC1E;AAEA,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM;AAG9B,UAAI,MAAO,OAAM,IAAI,MAAM,MAAM,OAAO;AAExC,YAAM,QAAS,QAAQ,CAAC,GAAoB,IAAI,aAAa;AAC7D,aAAO,EAAE,MAAM,KAAK,MAAM,GAAG,KAAK,GAAG,WAAW,KAAK,SAAS,MAAM;AAAA,IACtE;AAAA,IAEA,MAAM,YAAY,KAAmB;AACnC,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb;AAAA,QACC;AAAA,UACE,UAAU,IAAI;AAAA,UACd,SAAS,IAAI;AAAA,UACb,MAAM,IAAI;AAAA,UACV,OAAO,IAAI;AAAA,UACX,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,QACrC;AAAA,QACA,EAAE,YAAY,mBAAmB;AAAA,MACnC;AACF,aAAO,QACH,EAAE,SAAS,OAAO,OAAO,MAAM,QAAQ,IACvC,EAAE,SAAS,KAAK;AAAA,IACtB;AAAA;AAAA;AAAA,IAIA,MAAM,cAAc,SAAiB,QAAuC;AAC1E,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAC3B,OAAO,SAAS,EAChB,IAAI,kBAAkB,EAAE,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AAC3D,UAAI,OAAO;AAET,YAAI,CAAC,kBAAkB,KAAK,GAAG;AAC7B,kBAAQ,MAAM,+CAA+C,MAAM,OAAO;AAAA,QAC5E;AACA,eAAO,EAAE,MAAM,OAAO;AAAA,MACxB;AACA,YAAM,OAAO;AACb,aAAO,QAAQ,CAAC,YAAY,WAAW,MAAM,EAAE,SAAS,KAAK,IAAI,IAAI,OAAO,EAAE,MAAM,OAAO;AAAA,IAC7F;AAAA,IAEA,MAAM,eAAe,SAAiB,QAAyC;AAC7E,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAC3B,OAAO,SAAS,EAChB,IAAI,qBAAqB,EAAE,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AAC9D,UAAI,OAAO;AACT,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO,kBAAkB,KAAK,IAC1B,mGACA,MAAM,SAAS,UACb,8CACA,MAAM;AAAA,QACd;AAAA,MACF;AACA,YAAM,SAAS;AACf,UAAI,QAAQ,WAAW,cAAc,OAAO,OAAO;AACjD,cAAM,QAAQ,OAAO,OAAO,UAAU,WAAY,KAAK,MAAM,OAAO,KAAK,IAAsB,OAAO;AACtG,eAAO,EAAE,SAAS,MAAM,QAAQ,YAAY,MAAM;AAAA,MACpD;AACA,aAAO,EAAE,SAAS,MAAM,QAAQ,QAAQ,WAAW,UAAU,UAAU,OAAO;AAAA,IAChF;AAAA,IAEA,MAAM,gBAAgB,eAAuB,QAAgB;AAC3D,YAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAM,EAAE,MAAM,IAAI,MAAM,OACrB,OAAO,SAAS,EAChB,KAAK,QAAQ,EACb,OAAO,EACP,GAAG,WAAW,MAAM,EACpB,KAAK,YAAY,GAAG,aAAa,GAAG;AACvC,UAAI,OAAO;AACT,gBAAQ,MAAM,gDAAgD,MAAM,OAAO;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/cli/doctor.js

@@ -545,16 +545,19 @@ async function checkDatabase(ctx, sb) {
   }
   const admin = sb.createClient(ctx.url, ctx.serviceKey, { auth: { persistSession: false, autoRefreshToken: false } });
   const gr = () => admin.schema(GR_SCHEMA);
-  for (const table of [GR_MEMBERS_TABLE, "gr_content", "gr_repeater_items", "gr_rate_limits"]) {
-    const { error: error2 } = await gr().from(table).select("*", { head: true, count: "exact" }).limit(1);
+  for (const table of [GR_MEMBERS_TABLE, "gr_content", "gr_repeater_items", "gr_rate_limits", "gr_content_history"]) {
+    const { error: error2 } = await gr().from(table).select("*").limit(1);
     if (!error2) pass(`Table ${table}`);
     else if (table === "gr_rate_limits") warn("Table gr_rate_limits is missing", "Rate limits are counted in memory until the migration is applied.", "Run: pnpm exec guardrail-init-db --push");
+    else if (table === "gr_content_history") warn("Table gr_content_history is missing", "Editors won't be offered a revert button until the migration is applied.", "Run: pnpm exec guardrail-init-db --push");
     else fail(`Table ${table} isn't readable`, error2.message, "Run: pnpm exec guardrail-init-db --push");
   }
   const probes = [
     ["gr_confirmed_email", {}, "Confirmed-email identity check"],
     ["gr_claim_invite", { target_site: "doctor-probe" }, "Invite-claim function"],
-    ["gr_ensure_bucket", { target_bucket: "gr-doctor-probe" }, "Media bucket function"]
+    ["gr_ensure_bucket", { target_bucket: "gr-doctor-probe" }, "Media bucket function"],
+    ["gr_revert_content", { p_site: "doctor-probe", p_key: "doctor.probe" }, "Revert function"],
+    ["gr_revert_info", { p_site: "doctor-probe", p_key: "doctor.probe" }, "Revert-info function"]
   ];
   for (const [fn, args, label] of probes) {
     const { error: error2 } = await gr().rpc(fn, args);
@@ -835,6 +838,37 @@ async function runE2E(ctx, sb) {
       value: { type: "text", text: "nope" }
     });
     expect(Boolean(anonWrite.error), "Visitors can't write content", anonWrite.error ? void 0 : "An unauthenticated write was allowed.");
+    const histCount = async () => {
+      const r = await gr(admin).from("gr_content_history").select("id", { count: "exact", head: true }).eq("site_id", siteId).eq("path_key", "doctor.check");
+      return r.error ? -1 : r.count ?? 0;
+    };
+    const setText = (text) => gr(user).from("gr_content").update({ value: { type: "text", text }, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("site_id", siteId).eq("path_key", "doctor.check");
+    const current = async () => {
+      const r = await gr(user).from("gr_content").select("value").eq("site_id", siteId).eq("path_key", "doctor.check").maybeSingle();
+      return r.data?.value?.text ?? null;
+    };
+    const revertRpc = async (site = siteId) => {
+      const r = await gr(user).rpc("gr_revert_content", { p_site: site, p_key: "doctor.check" });
+      return { error: r.error, data: r.data };
+    };
+    await setText("v1");
+    await setText("v1");
+    const afterTwo = await histCount();
+    expect(afterTwo === 1, "A save keeps the old value in history, and re-saving the same value doesn't", `Expected 1 history entry, found ${afterTwo}.`, "Apply the latest migrations: pnpm exec guardrail-init-db --push");
+    const info1 = await gr(user).rpc("gr_revert_info", { p_site: siteId, p_key: "doctor.check" });
+    expect(info1.data?.kind === "previous", "The editor is told a previous version exists", info1.error?.message);
+    const peek = await gr(anon).from("gr_content_history").select("id").eq("site_id", siteId);
+    expect(Boolean(peek.error) || (peek.data?.length ?? 0) === 0, "Visitors can't read content history", peek.error ? void 0 : "An unauthenticated read returned history rows.");
+    const foreign = await revertRpc(otherSite);
+    expect(Boolean(foreign.error), "An editor can't revert another site's content", foreign.error ? void 0 : "The revert was allowed.");
+    const r1 = await revertRpc();
+    expect(!r1.error && r1.data?.action === "restored" && await current() === "doctor" && await histCount() === 0, "Revert steps back one version", r1.error?.message ?? `Got ${JSON.stringify(r1.data)}.`, "Apply the latest migrations: pnpm exec guardrail-init-db --push");
+    const r2 = await revertRpc();
+    expect(!r2.error && r2.data?.action === "reset" && await current() === null, "Revert with nothing earlier returns the field to its default", r2.error?.message ?? `Got ${JSON.stringify(r2.data)}.`);
+    await gr(user).from("gr_content").insert({ site_id: siteId, path_key: "doctor.check", type: "text", value: { type: "text", text: "n0" } });
+    for (let i = 1; i <= 22; i++) await setText(`n${i}`);
+    const kept = await histCount();
+    expect(kept === 20, "History keeps the newest 20 versions of a field", `Expected 20, found ${kept}.`, "Apply the latest migrations: pnpm exec guardrail-init-db --push");
     const demote = await gr(user).from(GR_MEMBERS_TABLE).update({ role: "editor" }).eq("site_id", siteId).eq("email", email);
     expect(
       Boolean(demote.error),