@guard-rail/core 0.3.0 → 0.5.0

package/dist/react/useAnchorRect.js

@@ -1,30 +1,58 @@
 "use client";
-import { useCallback, useEffect, useState } from "react";
-function useAnchorRect(ref, active) {
+import { useCallback, useEffect, useRef, useState } from "react";
+function useAnchorRect(ref, active, options = {}) {
+  const { gateByVisibility = false } = options;
   const [rect, setRect] = useState(null);
+  const rafRef = useRef(null);
   const measure = useCallback(() => {
     const el = ref.current;
     if (!el) return;
     const r = el.getBoundingClientRect();
     setRect({ top: r.top, left: r.left, bottom: r.bottom, width: r.width });
   }, [ref]);
+  const scheduleMeasure = useCallback(() => {
+    if (rafRef.current !== null) return;
+    rafRef.current = requestAnimationFrame(() => {
+      rafRef.current = null;
+      measure();
+    });
+  }, [measure]);
+  const [visible, setVisible] = useState(!gateByVisibility);
   useEffect(() => {
-    if (!active) {
+    if (!active || !gateByVisibility) return;
+    const el = ref.current;
+    if (!el || typeof IntersectionObserver === "undefined") {
+      setVisible(true);
+      return;
+    }
+    const io = new IntersectionObserver(
+      (entries) => setVisible(entries[0]?.isIntersecting ?? false),
+      { rootMargin: "200px" }
+    );
+    io.observe(el);
+    return () => io.disconnect();
+  }, [active, gateByVisibility, ref]);
+  useEffect(() => {
+    if (!active || gateByVisibility && !visible) {
       setRect(null);
       return;
     }
     measure();
-    window.addEventListener("scroll", measure, true);
-    window.addEventListener("resize", measure);
-    const observer = typeof ResizeObserver !== "undefined" ? new ResizeObserver(measure) : null;
+    window.addEventListener("scroll", scheduleMeasure, true);
+    window.addEventListener("resize", scheduleMeasure);
+    const observer = typeof ResizeObserver !== "undefined" ? new ResizeObserver(scheduleMeasure) : null;
     if (observer && ref.current) observer.observe(ref.current);
     if (observer) observer.observe(document.body);
     return () => {
-      window.removeEventListener("scroll", measure, true);
-      window.removeEventListener("resize", measure);
+      window.removeEventListener("scroll", scheduleMeasure, true);
+      window.removeEventListener("resize", scheduleMeasure);
       observer?.disconnect();
+      if (rafRef.current !== null) {
+        cancelAnimationFrame(rafRef.current);
+        rafRef.current = null;
+      }
     };
-  }, [active, measure, ref]);
+  }, [active, gateByVisibility, visible, measure, scheduleMeasure, ref]);
   return rect;
 }
 export {

package/dist/react/useAnchorRect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/useAnchorRect.ts"],"sourcesContent":["\"use client\";\n\nimport { useCallback, useEffect, useState, type RefObject } from \"react\";\n\nexport interface AnchorRect {\n  top: number;\n  left: number;\n  bottom: number;\n  width: number;\n}\n\n/**\n * Tracks an element's viewport rect so editing chrome can sit against it.\n *\n * Listens on the capture phase so scrolling inside any ancestor container\n * repositions the chrome, not just window scroll.\n */\nexport function useAnchorRect(\n  ref: RefObject<HTMLElement | null>,\n  active: boolean,\n): AnchorRect | null {\n  const [rect, setRect] = useState<AnchorRect | null>(null);\n\n  const measure = useCallback(() => {\n    const el = ref.current;\n    if (!el) return;\n    const r = el.getBoundingClientRect();\n    setRect({ top: r.top, left: r.left, bottom: r.bottom, width: r.width });\n  }, [ref]);\n\n  useEffect(() => {\n    if (!active) {\n      setRect(null);\n      return;\n    }\n\n    measure();\n    window.addEventListener(\"scroll\", measure, true);\n    window.addEventListener(\"resize\", measure);\n\n    // Catches layout shifts from the edit itself (text reflowing the element).\n    const observer =\n      typeof ResizeObserver !== \"undefined\" ? new ResizeObserver(measure) : null;\n    if (observer && ref.current) observer.observe(ref.current);\n    // Content changing size above or beside the element moves it without\n    // resizing it, which observing the element alone never sees. The body's\n    // own height changes in most of those cases.\n    if (observer) observer.observe(document.body);\n\n    return () => {\n      window.removeEventListener(\"scroll\", measure, true);\n      window.removeEventListener(\"resize\", measure);\n      observer?.disconnect();\n    };\n  }, [active, measure, ref]);\n\n  return rect;\n}\n"],"mappings":";AAEA,SAAS,aAAa,WAAW,gBAAgC;AAe1D,SAAS,cACd,KACA,QACmB;AACnB,QAAM,CAAC,MAAM,OAAO,IAAI,SAA4B,IAAI;AAExD,QAAM,UAAU,YAAY,MAAM;AAChC,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,GAAI;AACT,UAAM,IAAI,GAAG,sBAAsB;AACnC,YAAQ,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,CAAC;AAAA,EACxE,GAAG,CAAC,GAAG,CAAC;AAER,YAAU,MAAM;AACd,QAAI,CAAC,QAAQ;AACX,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,YAAQ;AACR,WAAO,iBAAiB,UAAU,SAAS,IAAI;AAC/C,WAAO,iBAAiB,UAAU,OAAO;AAGzC,UAAM,WACJ,OAAO,mBAAmB,cAAc,IAAI,eAAe,OAAO,IAAI;AACxE,QAAI,YAAY,IAAI,QAAS,UAAS,QAAQ,IAAI,OAAO;AAIzD,QAAI,SAAU,UAAS,QAAQ,SAAS,IAAI;AAE5C,WAAO,MAAM;AACX,aAAO,oBAAoB,UAAU,SAAS,IAAI;AAClD,aAAO,oBAAoB,UAAU,OAAO;AAC5C,gBAAU,WAAW;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,QAAQ,SAAS,GAAG,CAAC;AAEzB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/react/useAnchorRect.ts"],"sourcesContent":["\"use client\";\n\nimport { useCallback, useEffect, useRef, useState, type RefObject } from \"react\";\n\nexport interface AnchorRect {\n  top: number;\n  left: number;\n  bottom: number;\n  width: number;\n}\n\n/**\n * Tracks an element's viewport rect so editing chrome can sit against it.\n *\n * Listens on the capture phase so scrolling inside any ancestor container\n * repositions the chrome, not just window scroll.\n *\n * Two things keep this cheap when many elements track at once (every image\n * field does, for its idle marker, for as long as edit mode is on — not just\n * the one actively being edited):\n *\n * - Measurement is coalesced to one requestAnimationFrame per scroll/resize\n *   burst, not one per raw event. A scroll can fire far more of those than\n *   the page ever paints, so N tracked elements without this meant N\n *   getBoundingClientRect() calls and N re-renders per event, not per frame.\n * - `gateByVisibility` skips attaching any listener at all — scroll, resize,\n *   or the ResizeObserver — for an element nowhere near the viewport, via\n *   IntersectionObserver. A long page with many editable images then only\n *   pays for the handful actually in view at a given scroll position, not\n *   all of them.\n */\nexport function useAnchorRect(\n  ref: RefObject<HTMLElement | null>,\n  active: boolean,\n  options: { gateByVisibility?: boolean } = {},\n): AnchorRect | null {\n  const { gateByVisibility = false } = options;\n  const [rect, setRect] = useState<AnchorRect | null>(null);\n  const rafRef = useRef<number | null>(null);\n\n  const measure = useCallback(() => {\n    const el = ref.current;\n    if (!el) return;\n    const r = el.getBoundingClientRect();\n    setRect({ top: r.top, left: r.left, bottom: r.bottom, width: r.width });\n  }, [ref]);\n\n  const scheduleMeasure = useCallback(() => {\n    if (rafRef.current !== null) return;\n    rafRef.current = requestAnimationFrame(() => {\n      rafRef.current = null;\n      measure();\n    });\n  }, [measure]);\n\n  const [visible, setVisible] = useState(!gateByVisibility);\n\n  useEffect(() => {\n    if (!active || !gateByVisibility) return;\n    const el = ref.current;\n    if (!el || typeof IntersectionObserver === \"undefined\") {\n      setVisible(true);\n      return;\n    }\n    // A margin outside the viewport, not just inside it — so tracking (and\n    // the marker) is already live the instant an image scrolls into view,\n    // not a frame behind.\n    const io = new IntersectionObserver(\n      (entries) => setVisible(entries[0]?.isIntersecting ?? false),\n      { rootMargin: \"200px\" },\n    );\n    io.observe(el);\n    return () => io.disconnect();\n  }, [active, gateByVisibility, ref]);\n\n  useEffect(() => {\n    if (!active || (gateByVisibility && !visible)) {\n      setRect(null);\n      return;\n    }\n\n    measure();\n    window.addEventListener(\"scroll\", scheduleMeasure, true);\n    window.addEventListener(\"resize\", scheduleMeasure);\n\n    // Catches layout shifts from the edit itself (text reflowing the element).\n    const observer =\n      typeof ResizeObserver !== \"undefined\" ? new ResizeObserver(scheduleMeasure) : null;\n    if (observer && ref.current) observer.observe(ref.current);\n    // Content changing size above or beside the element moves it without\n    // resizing it, which observing the element alone never sees. The body's\n    // own height changes in most of those cases.\n    if (observer) observer.observe(document.body);\n\n    return () => {\n      window.removeEventListener(\"scroll\", scheduleMeasure, true);\n      window.removeEventListener(\"resize\", scheduleMeasure);\n      observer?.disconnect();\n      if (rafRef.current !== null) {\n        cancelAnimationFrame(rafRef.current);\n        rafRef.current = null;\n      }\n    };\n  }, [active, gateByVisibility, visible, measure, scheduleMeasure, ref]);\n\n  return rect;\n}\n"],"mappings":";AAEA,SAAS,aAAa,WAAW,QAAQ,gBAAgC;AA6BlE,SAAS,cACd,KACA,QACA,UAA0C,CAAC,GACxB;AACnB,QAAM,EAAE,mBAAmB,MAAM,IAAI;AACrC,QAAM,CAAC,MAAM,OAAO,IAAI,SAA4B,IAAI;AACxD,QAAM,SAAS,OAAsB,IAAI;AAEzC,QAAM,UAAU,YAAY,MAAM;AAChC,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,GAAI;AACT,UAAM,IAAI,GAAG,sBAAsB;AACnC,YAAQ,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,CAAC;AAAA,EACxE,GAAG,CAAC,GAAG,CAAC;AAER,QAAM,kBAAkB,YAAY,MAAM;AACxC,QAAI,OAAO,YAAY,KAAM;AAC7B,WAAO,UAAU,sBAAsB,MAAM;AAC3C,aAAO,UAAU;AACjB,cAAQ;AAAA,IACV,CAAC;AAAA,EACH,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,CAAC,gBAAgB;AAExD,YAAU,MAAM;AACd,QAAI,CAAC,UAAU,CAAC,iBAAkB;AAClC,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,MAAM,OAAO,yBAAyB,aAAa;AACtD,iBAAW,IAAI;AACf;AAAA,IACF;AAIA,UAAM,KAAK,IAAI;AAAA,MACb,CAAC,YAAY,WAAW,QAAQ,CAAC,GAAG,kBAAkB,KAAK;AAAA,MAC3D,EAAE,YAAY,QAAQ;AAAA,IACxB;AACA,OAAG,QAAQ,EAAE;AACb,WAAO,MAAM,GAAG,WAAW;AAAA,EAC7B,GAAG,CAAC,QAAQ,kBAAkB,GAAG,CAAC;AAElC,YAAU,MAAM;AACd,QAAI,CAAC,UAAW,oBAAoB,CAAC,SAAU;AAC7C,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,YAAQ;AACR,WAAO,iBAAiB,UAAU,iBAAiB,IAAI;AACvD,WAAO,iBAAiB,UAAU,eAAe;AAGjD,UAAM,WACJ,OAAO,mBAAmB,cAAc,IAAI,eAAe,eAAe,IAAI;AAChF,QAAI,YAAY,IAAI,QAAS,UAAS,QAAQ,IAAI,OAAO;AAIzD,QAAI,SAAU,UAAS,QAAQ,SAAS,IAAI;AAE5C,WAAO,MAAM;AACX,aAAO,oBAAoB,UAAU,iBAAiB,IAAI;AAC1D,aAAO,oBAAoB,UAAU,eAAe;AACpD,gBAAU,WAAW;AACrB,UAAI,OAAO,YAAY,MAAM;AAC3B,6BAAqB,OAAO,OAAO;AACnC,eAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,QAAQ,kBAAkB,SAAS,SAAS,iBAAiB,GAAG,CAAC;AAErE,SAAO;AACT;","names":[]}

package/dist/server/actions.d.ts

@@ -1,5 +1,5 @@
-import { GRRole, GRAsset, GRMember, ActionState, GRViewer, OverrideRow } from '../core/types.js';
-import { GRUploadTarget } from '../core/adapter-types.js';
+import { GRRole, GRAsset, GRMember, SetPasswordState, ActionState, GRViewer, OverrideRow } from '../core/types.js';
+import { GRUploadTarget, AuthRedirectParams } from '../core/adapter-types.js';
 import 'react';
 
 type Result = {
@@ -37,5 +37,33 @@ declare function loginAction(_prev: ActionState, formData: FormData): Promise<Ac
 declare function logoutAction(): Promise<{
     success: boolean;
 }>;
+/**
+ * Completes a session that arrived via an invite, magic-link, or
+ * password-recovery redirect. Called by AuthRedirectSync (react/), the
+ * generic client component that notices this kind of link and hands off
+ * whatever it found in the URL — the actual token exchange is entirely the
+ * auth adapter's job (see GRAuthAdapter.completeAuthRedirect); core only
+ * orchestrates the result.
+ *
+ * A no-op {success:false}, not an error, when the adapter doesn't implement
+ * this — most page loads carry no redirect data at all, and an adapter with
+ * no such concept should not make every one of them fail.
+ */
+declare function completeAuthRedirectAction(params: AuthRedirectParams): Promise<{
+    success: boolean;
+    needsPassword?: boolean;
+    error?: string;
+}>;
+/**
+ * Sets the current session's password — the prompt completeAuthRedirectAction
+ * triggers via needsPassword. Requires only a valid session, not a role: an
+ * invited person's role is claimed as a side effect of getCachedViewer()
+ * resolving them, which already happens independently of this.
+ */
+declare function setPasswordAction(_prev: SetPasswordState, formData: FormData): Promise<SetPasswordState>;
+/** Dismisses the set-password prompt without setting one — see Admin.tsx. */
+declare function skipSetPasswordAction(): Promise<{
+    success: boolean;
+}>;
 
-export { createAssetUpload, inviteMember, listAssets, listTeam, loginAction, logoutAction, removeMember, requireRole, saveOverride, updateMemberRole };
+export { completeAuthRedirectAction, createAssetUpload, inviteMember, listAssets, listTeam, loginAction, logoutAction, removeMember, requireRole, saveOverride, setPasswordAction, skipSetPasswordAction, updateMemberRole };

package/dist/server/actions.js

@@ -1,6 +1,6 @@
 "use server";
 import { revalidatePath } from "next/cache";
-import { headers } from "next/headers";
+import { cookies, headers } from "next/headers";
 import {
   getAuth,
   getDB,
@@ -11,6 +11,7 @@ import {
 } from "../core/config";
 import { getCachedViewer } from "./session";
 import { rethrowIfBailout } from "../core/bailout";
+import { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from "../core/defs";
 const DENIED = { success: false, error: "Unauthorized." };
 async function requireRole(allowed) {
   const viewer = await getCachedViewer();
@@ -196,10 +197,51 @@ async function loginAction(_prev, formData) {
 async function logoutAction() {
   const auth = getAuth();
   await auth.logout();
+  const cookieStore = await cookies();
+  cookieStore.delete(GR_COOKIES.EDIT_MODE);
+  revalidatePath("/", "layout");
+  return { success: true };
+}
+async function completeAuthRedirectAction(params) {
+  const auth = getAuth();
+  if (!auth.completeAuthRedirect) return { success: false };
+  const res = await auth.completeAuthRedirect(params);
+  if (res.success) {
+    if (res.needsPassword) {
+      const cookieStore = await cookies();
+      cookieStore.set(GR_COOKIES.NEEDS_PASSWORD, "true", {
+        path: "/",
+        maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS
+      });
+    }
+    revalidatePath("/", "layout");
+  }
+  return res;
+}
+async function setPasswordAction(_prev, formData) {
+  const viewer = await getCachedViewer();
+  if (!viewer) return { success: false, error: "Not signed in." };
+  const auth = getAuth();
+  if (!auth.setPassword) {
+    return { success: false, error: "This site's auth provider does not support setting a password." };
+  }
+  const password = String(formData.get("password") ?? "");
+  const res = await auth.setPassword(password);
+  if (res.success) {
+    const cookieStore = await cookies();
+    cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);
+    revalidatePath("/", "layout");
+  }
+  return res;
+}
+async function skipSetPasswordAction() {
+  const cookieStore = await cookies();
+  cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);
   revalidatePath("/", "layout");
   return { success: true };
 }
 export {
+  completeAuthRedirectAction,
   createAssetUpload,
   inviteMember,
   listAssets,
@@ -209,6 +251,8 @@ export {
   removeMember,
   requireRole,
   saveOverride,
+  setPasswordAction,
+  skipSetPasswordAction,
   updateMemberRole
 };
 //# sourceMappingURL=actions.js.map

package/dist/server/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/actions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { headers } from \"next/headers\";\nimport {\n  getAuth,\n  getDB,\n  getInviteHandler,\n  getMembers,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type {\n  ActionState,\n  GRAsset,\n  GRMember,\n  GRRole,\n  GRViewer,\n  OverrideRow,\n} from \"../core/types\";\nimport type { GRStorageRow, GRUploadTarget } from \"../core/adapter-types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\n/**\n * Every mutation re-resolves the viewer server-side. The client's copy of the\n * role decides what to *show*; it never decides what is *allowed*. A hidden\n * button is not authorization — this is the same lesson as the session cookie.\n */\nexport async function requireRole(\n  allowed: readonly GRRole[],\n): Promise<GRViewer | null> {\n  const viewer = await getCachedViewer();\n  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;\n  return viewer;\n}\n\nexport async function saveOverride(row: OverrideRow): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  const rowToSend: GRStorageRow = {\n    pathKey: row.pathKey,\n    siteId: await resolveSiteId(),\n    type: row.value.type,\n    value: row.value,\n  };\n\n  try {\n    const db = getDB();\n    const res = await db.setOverride(rowToSend);\n    if (!res.success) return res;\n\n    // TODO: too broad — purges every cached route on any single-field save.\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: save failed\", e);\n    return { success: false, error: \"Database write failed.\" };\n  }\n}\n\n/* --------------------------------------------------------------- media --- */\n\n// SVG is excluded on purpose: it can carry script, and next/image refuses it\n// by default anyway.\nconst IMAGE_TYPES = [\"image/png\", \"image/jpeg\", \"image/webp\", \"image/gif\", \"image/avif\"];\nconst MAX_UPLOAD_BYTES = 10 * 1024 * 1024;\n\n/**\n * Authorizes an upload and returns where the browser should send the bytes.\n * Only metadata comes through here — the file itself goes straight to storage.\n */\nexport async function createAssetUpload(file: {\n  name: string;\n  contentType: string;\n  size: number;\n}): Promise<\n  { success: true; target: GRUploadTarget } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  const storage = getStorage();\n  if (!storage) {\n    return { success: false, error: \"No storage adapter is configured.\" };\n  }\n  if (!IMAGE_TYPES.includes(file.contentType)) {\n    return { success: false, error: \"Upload a PNG, JPEG, WebP, GIF, or AVIF image.\" };\n  }\n  if (!(file.size > 0) || file.size > MAX_UPLOAD_BYTES) {\n    return { success: false, error: \"Images must be under 10 MB.\" };\n  }\n\n  try {\n    const target = await storage.createUpload(await resolveSiteId(), file);\n    return { success: true, target };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: createUpload failed\", e);\n    // Failures here are almost always setup (missing SQL, bucket, or policy),\n    // so show the cause while developing. Production keeps it generic rather\n    // than exposing backend detail to editors.\n    const detail =\n      process.env.NODE_ENV !== \"production\" && e instanceof Error\n        ? ` ${e.message}`\n        : \"\";\n    return { success: false, error: `Could not start the upload.${detail}` };\n  }\n}\n\nexport async function listAssets(): Promise<GRAsset[]> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  const storage = getStorage();\n  if (!viewer || !storage) return [];\n  return storage.listAssets(await resolveSiteId());\n}\n\n/* ---------------------------------------------------------------- team --- */\n\nexport async function listTeam(): Promise<GRMember[]> {\n  // Any member may see who else is on the site; only admins may change it.\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return [];\n\n  const members = getMembers();\n  return members.listMembers(await resolveSiteId());\n}\n\nexport async function inviteMember(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const normalized = email.toLowerCase().trim();\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(normalized)) {\n    return { success: false, error: \"Enter a valid email address.\" };\n  }\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const existing = await members.getMember(siteId, { email: normalized });\n  if (existing?.status === \"active\") {\n    return { success: false, error: \"That address is already on the team.\" };\n  }\n\n  // A pending invite is re-sent rather than rejected: provider email is\n  // rate-limited and unreliable enough that resending has to be possible.\n  if (!existing) {\n    const res = await members.upsertMember(siteId, {\n      email: normalized,\n      role,\n      userId: null,\n      status: \"pending\",\n    });\n    if (!res.success) return res;\n  }\n\n  const auth = getAuth();\n  if (auth.inviteUser) {\n    // The membership is already written; a failed send must not undo it.\n    const sent = await auth.inviteUser(normalized, {\n      redirectTo: `${await requestOrigin()}/?edit=true`,\n    });\n    revalidatePath(\"/\", \"layout\");\n    return sent.success\n      ? { success: true }\n      : {\n          success: false,\n          error: `Invite saved, but the email failed: ${sent.error}`,\n        };\n  }\n\n  // No provider-side delivery, so hand off to the app.\n  try {\n    await getInviteHandler()?.({\n      email: normalized,\n      role: existing?.role ?? role,\n      siteId,\n      invitedBy: viewer.email ?? viewer.userId,\n    });\n  } catch (e) {\n    console.error(\"Guardrail: onInvite handler threw\", e);\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\nexport async function updateMemberRole(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const target = await members.getMember(siteId, {\n    email: email.toLowerCase().trim(),\n  });\n  if (!target) return { success: false, error: \"No such member.\" };\n\n  if (target.role === \"admin\" && role !== \"admin\") {\n    const guard = await wouldStrandSite(siteId, target.email);\n    if (guard) return guard;\n  }\n\n  const res = await members.upsertMember(siteId, {\n    email: target.email,\n    role,\n    userId: target.userId,\n    status: target.status,\n  });\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nexport async function removeMember(email: string): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n  const normalized = email.toLowerCase().trim();\n\n  const guard = await wouldStrandSite(siteId, normalized);\n  if (guard) return guard;\n\n  const res = await members.removeMember(siteId, normalized);\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nasync function requestOrigin(): Promise<string> {\n  const h = await headers();\n  const origin = h.get(\"origin\");\n  if (origin) return origin;\n  const host = h.get(\"x-forwarded-host\") ?? h.get(\"host\") ?? \"localhost\";\n  const proto = h.get(\"x-forwarded-proto\") ?? (host.startsWith(\"localhost\") ? \"http\" : \"https\");\n  return `${proto}://${host}`;\n}\n\n/**\n * Refuses changes that would leave a site with no admin, which would lock\n * everyone out of team management with no in-app way to recover.\n */\nasync function wouldStrandSite(\n  siteId: string,\n  email: string,\n): Promise<Result | null> {\n  const members = getMembers();\n  const all = await members.listMembers(siteId);\n  const admins = all.filter((m) => m.role === \"admin\");\n\n  if (admins.length <= 1 && admins.some((m) => m.email === email)) {\n    return {\n      success: false,\n      error: \"A site must keep at least one admin.\",\n    };\n  }\n  return null;\n}\n\n/* ---------------------------------------------------------------- auth --- */\n\nexport async function loginAction(\n  _prev: ActionState,\n  formData: FormData,\n): Promise<ActionState> {\n  const email = String(formData.get(\"email\") ?? \"\");\n  const password = String(formData.get(\"password\") ?? \"\");\n\n  const auth = getAuth();\n  if (!auth.authenticate) {\n    return {\n      success: false,\n      error: \"This site's auth provider does not accept passwords.\",\n      email,\n    };\n  }\n\n  const result = await auth.authenticate(email, password);\n  if (!result.success) {\n    return { success: false, error: result.error, email };\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true, email };\n}\n\nexport async function logoutAction(): Promise<{ success: boolean }> {\n  const auth = getAuth();\n  await auth.logout();\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AAajC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAOhE,eAAsB,YACpB,SAC0B;AAC1B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,eAAsB,aAAa,KAAmC;AACpE,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,YAA0B;AAAA,IAC9B,SAAS,IAAI;AAAA,IACb,QAAQ,MAAM,cAAc;AAAA,IAC5B,MAAM,IAAI,MAAM;AAAA,IAChB,OAAO,IAAI;AAAA,EACb;AAEA,MAAI;AACF,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,MAAM,GAAG,YAAY,SAAS;AAC1C,QAAI,CAAC,IAAI,QAAS,QAAO;AAGzB,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0BAA0B,CAAC;AACzC,WAAO,EAAE,SAAS,OAAO,OAAO,yBAAyB;AAAA,EAC3D;AACF;AAMA,MAAM,cAAc,CAAC,aAAa,cAAc,cAAc,aAAa,YAAY;AACvF,MAAM,mBAAmB,KAAK,OAAO;AAMrC,eAAsB,kBAAkB,MAMtC;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,oCAAoC;AAAA,EACtE;AACA,MAAI,CAAC,YAAY,SAAS,KAAK,WAAW,GAAG;AAC3C,WAAO,EAAE,SAAS,OAAO,OAAO,gDAAgD;AAAA,EAClF;AACA,MAAI,EAAE,KAAK,OAAO,MAAM,KAAK,OAAO,kBAAkB;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B;AAAA,EAChE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,cAAc,GAAG,IAAI;AACrE,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,kCAAkC,CAAC;AAIjD,UAAM,SACJ,QAAQ,IAAI,aAAa,gBAAgB,aAAa,QAClD,IAAI,EAAE,OAAO,KACb;AACN,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B,MAAM,GAAG;AAAA,EACzE;AACF;AAEA,eAAsB,aAAiC;AACrD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO,CAAC;AACjC,SAAO,QAAQ,WAAW,MAAM,cAAc,CAAC;AACjD;AAIA,eAAsB,WAAgC;AAEpD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,UAAU,WAAW;AAC3B,SAAO,QAAQ,YAAY,MAAM,cAAc,CAAC;AAClD;AAEA,eAAsB,aACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAC5C,MAAI,CAAC,6BAA6B,KAAK,UAAU,GAAG;AAClD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AAEA,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,EAAE,OAAO,WAAW,CAAC;AACtE,MAAI,UAAU,WAAW,UAAU;AACjC,WAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,EACzE;AAIA,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,MAC7C,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,QAAS,QAAO;AAAA,EAC3B;AAEA,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,YAAY;AAEnB,UAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAAA,MAC7C,YAAY,GAAG,MAAM,cAAc,CAAC;AAAA,IACtC,CAAC;AACD,mBAAe,KAAK,QAAQ;AAC5B,WAAO,KAAK,UACR,EAAE,SAAS,KAAK,IAChB;AAAA,MACE,SAAS;AAAA,MACT,OAAO,uCAAuC,KAAK,KAAK;AAAA,IAC1D;AAAA,EACN;AAGA,MAAI;AACF,UAAM,iBAAiB,IAAI;AAAA,MACzB,OAAO;AAAA,MACP,MAAM,UAAU,QAAQ;AAAA,MACxB;AAAA,MACA,WAAW,OAAO,SAAS,OAAO;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,GAAG;AACV,YAAQ,MAAM,qCAAqC,CAAC;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAsB,iBACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ;AAAA,IAC7C,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAE/D,MAAI,OAAO,SAAS,WAAW,SAAS,SAAS;AAC/C,UAAM,QAAQ,MAAM,gBAAgB,QAAQ,OAAO,KAAK;AACxD,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,IAC7C,OAAO,OAAO;AAAA,IACd;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAsB,aAAa,OAAgC;AACjE,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAE5C,QAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,MAAI,MAAO,QAAO;AAElB,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ,UAAU;AACzD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAe,gBAAiC;AAC9C,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,QAAQ;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,OAAO,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,MAAM,KAAK;AAC3D,QAAM,QAAQ,EAAE,IAAI,mBAAmB,MAAM,KAAK,WAAW,WAAW,IAAI,SAAS;AACrF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAMA,eAAe,gBACb,QACA,OACwB;AACxB,QAAM,UAAU,WAAW;AAC3B,QAAM,MAAM,MAAM,QAAQ,YAAY,MAAM;AAC5C,QAAM,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO;AAEnD,MAAI,OAAO,UAAU,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIA,eAAsB,YACpB,OACA,UACsB;AACtB,QAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAChD,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AAEtD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,cAAc;AACtB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,KAAK,aAAa,OAAO,QAAQ;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,SAAS,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,MAAM,MAAM;AAChC;AAEA,eAAsB,eAA8C;AAClE,QAAM,OAAO,QAAQ;AACrB,QAAM,KAAK,OAAO;AAClB,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;","names":[]}
+{"version":3,"sources":["../../src/server/actions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { cookies, headers } from \"next/headers\";\nimport {\n  getAuth,\n  getDB,\n  getInviteHandler,\n  getMembers,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from \"../core/defs\";\nimport type {\n  ActionState,\n  GRAsset,\n  GRMember,\n  GRRole,\n  GRViewer,\n  OverrideRow,\n  SetPasswordState,\n} from \"../core/types\";\nimport type {\n  AuthRedirectParams,\n  GRStorageRow,\n  GRUploadTarget,\n} from \"../core/adapter-types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\n/**\n * Every mutation re-resolves the viewer server-side. The client's copy of the\n * role decides what to *show*; it never decides what is *allowed*. A hidden\n * button is not authorization — this is the same lesson as the session cookie.\n */\nexport async function requireRole(\n  allowed: readonly GRRole[],\n): Promise<GRViewer | null> {\n  const viewer = await getCachedViewer();\n  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;\n  return viewer;\n}\n\nexport async function saveOverride(row: OverrideRow): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  const rowToSend: GRStorageRow = {\n    pathKey: row.pathKey,\n    siteId: await resolveSiteId(),\n    type: row.value.type,\n    value: row.value,\n  };\n\n  try {\n    const db = getDB();\n    const res = await db.setOverride(rowToSend);\n    if (!res.success) return res;\n\n    // TODO: too broad — purges every cached route on any single-field save.\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: save failed\", e);\n    return { success: false, error: \"Database write failed.\" };\n  }\n}\n\n/* --------------------------------------------------------------- media --- */\n\n// SVG is excluded on purpose: it can carry script, and next/image refuses it\n// by default anyway.\nconst IMAGE_TYPES = [\"image/png\", \"image/jpeg\", \"image/webp\", \"image/gif\", \"image/avif\"];\nconst MAX_UPLOAD_BYTES = 10 * 1024 * 1024;\n\n/**\n * Authorizes an upload and returns where the browser should send the bytes.\n * Only metadata comes through here — the file itself goes straight to storage.\n */\nexport async function createAssetUpload(file: {\n  name: string;\n  contentType: string;\n  size: number;\n}): Promise<\n  { success: true; target: GRUploadTarget } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  const storage = getStorage();\n  if (!storage) {\n    return { success: false, error: \"No storage adapter is configured.\" };\n  }\n  if (!IMAGE_TYPES.includes(file.contentType)) {\n    return { success: false, error: \"Upload a PNG, JPEG, WebP, GIF, or AVIF image.\" };\n  }\n  if (!(file.size > 0) || file.size > MAX_UPLOAD_BYTES) {\n    return { success: false, error: \"Images must be under 10 MB.\" };\n  }\n\n  try {\n    const target = await storage.createUpload(await resolveSiteId(), file);\n    return { success: true, target };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: createUpload failed\", e);\n    // Failures here are almost always setup (missing SQL, bucket, or policy),\n    // so show the cause while developing. Production keeps it generic rather\n    // than exposing backend detail to editors.\n    const detail =\n      process.env.NODE_ENV !== \"production\" && e instanceof Error\n        ? ` ${e.message}`\n        : \"\";\n    return { success: false, error: `Could not start the upload.${detail}` };\n  }\n}\n\nexport async function listAssets(): Promise<GRAsset[]> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  const storage = getStorage();\n  if (!viewer || !storage) return [];\n  return storage.listAssets(await resolveSiteId());\n}\n\n/* ---------------------------------------------------------------- team --- */\n\nexport async function listTeam(): Promise<GRMember[]> {\n  // Any member may see who else is on the site; only admins may change it.\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return [];\n\n  const members = getMembers();\n  return members.listMembers(await resolveSiteId());\n}\n\nexport async function inviteMember(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const normalized = email.toLowerCase().trim();\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(normalized)) {\n    return { success: false, error: \"Enter a valid email address.\" };\n  }\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const existing = await members.getMember(siteId, { email: normalized });\n  if (existing?.status === \"active\") {\n    return { success: false, error: \"That address is already on the team.\" };\n  }\n\n  // A pending invite is re-sent rather than rejected: provider email is\n  // rate-limited and unreliable enough that resending has to be possible.\n  if (!existing) {\n    const res = await members.upsertMember(siteId, {\n      email: normalized,\n      role,\n      userId: null,\n      status: \"pending\",\n    });\n    if (!res.success) return res;\n  }\n\n  const auth = getAuth();\n  if (auth.inviteUser) {\n    // The membership is already written; a failed send must not undo it.\n    const sent = await auth.inviteUser(normalized, {\n      redirectTo: `${await requestOrigin()}/?edit=true`,\n    });\n    revalidatePath(\"/\", \"layout\");\n    return sent.success\n      ? { success: true }\n      : {\n          success: false,\n          error: `Invite saved, but the email failed: ${sent.error}`,\n        };\n  }\n\n  // No provider-side delivery, so hand off to the app.\n  try {\n    await getInviteHandler()?.({\n      email: normalized,\n      role: existing?.role ?? role,\n      siteId,\n      invitedBy: viewer.email ?? viewer.userId,\n    });\n  } catch (e) {\n    console.error(\"Guardrail: onInvite handler threw\", e);\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\nexport async function updateMemberRole(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const target = await members.getMember(siteId, {\n    email: email.toLowerCase().trim(),\n  });\n  if (!target) return { success: false, error: \"No such member.\" };\n\n  if (target.role === \"admin\" && role !== \"admin\") {\n    const guard = await wouldStrandSite(siteId, target.email);\n    if (guard) return guard;\n  }\n\n  const res = await members.upsertMember(siteId, {\n    email: target.email,\n    role,\n    userId: target.userId,\n    status: target.status,\n  });\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nexport async function removeMember(email: string): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n  const normalized = email.toLowerCase().trim();\n\n  const guard = await wouldStrandSite(siteId, normalized);\n  if (guard) return guard;\n\n  const res = await members.removeMember(siteId, normalized);\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nasync function requestOrigin(): Promise<string> {\n  const h = await headers();\n  const origin = h.get(\"origin\");\n  if (origin) return origin;\n  const host = h.get(\"x-forwarded-host\") ?? h.get(\"host\") ?? \"localhost\";\n  const proto = h.get(\"x-forwarded-proto\") ?? (host.startsWith(\"localhost\") ? \"http\" : \"https\");\n  return `${proto}://${host}`;\n}\n\n/**\n * Refuses changes that would leave a site with no admin, which would lock\n * everyone out of team management with no in-app way to recover.\n */\nasync function wouldStrandSite(\n  siteId: string,\n  email: string,\n): Promise<Result | null> {\n  const members = getMembers();\n  const all = await members.listMembers(siteId);\n  const admins = all.filter((m) => m.role === \"admin\");\n\n  if (admins.length <= 1 && admins.some((m) => m.email === email)) {\n    return {\n      success: false,\n      error: \"A site must keep at least one admin.\",\n    };\n  }\n  return null;\n}\n\n/* ---------------------------------------------------------------- auth --- */\n\nexport async function loginAction(\n  _prev: ActionState,\n  formData: FormData,\n): Promise<ActionState> {\n  const email = String(formData.get(\"email\") ?? \"\");\n  const password = String(formData.get(\"password\") ?? \"\");\n\n  const auth = getAuth();\n  if (!auth.authenticate) {\n    return {\n      success: false,\n      error: \"This site's auth provider does not accept passwords.\",\n      email,\n    };\n  }\n\n  const result = await auth.authenticate(email, password);\n  if (!result.success) {\n    return { success: false, error: result.error, email };\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true, email };\n}\n\nexport async function logoutAction(): Promise<{ success: boolean }> {\n  const auth = getAuth();\n  await auth.logout();\n  // Cleared here, not by the client afterward: a Server Action's own\n  // revalidatePath() below triggers Next's router to refresh the current\n  // route automatically, which can race a client-side navigation attempted\n  // right after this resolves — confirmed live, where that automatic\n  // refresh (for the pre-logout URL, ?edit=true) won the race and silently\n  // undid a client-side `window.location.href` to the plain path. Deleting\n  // the cookie here instead makes it part of the one server round-trip that\n  // revalidatePath already accounts for, with nothing left to race.\n  const cookieStore = await cookies();\n  cookieStore.delete(GR_COOKIES.EDIT_MODE);\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\n/* ---------------------------------------------------------- redirects --- */\n\n/**\n * Completes a session that arrived via an invite, magic-link, or\n * password-recovery redirect. Called by AuthRedirectSync (react/), the\n * generic client component that notices this kind of link and hands off\n * whatever it found in the URL — the actual token exchange is entirely the\n * auth adapter's job (see GRAuthAdapter.completeAuthRedirect); core only\n * orchestrates the result.\n *\n * A no-op {success:false}, not an error, when the adapter doesn't implement\n * this — most page loads carry no redirect data at all, and an adapter with\n * no such concept should not make every one of them fail.\n */\nexport async function completeAuthRedirectAction(\n  params: AuthRedirectParams,\n): Promise<{ success: boolean; needsPassword?: boolean; error?: string }> {\n  const auth = getAuth();\n  if (!auth.completeAuthRedirect) return { success: false };\n\n  const res = await auth.completeAuthRedirect(params);\n  if (res.success) {\n    if (res.needsPassword) {\n      const cookieStore = await cookies();\n      cookieStore.set(GR_COOKIES.NEEDS_PASSWORD, \"true\", {\n        path: \"/\",\n        maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS,\n      });\n    }\n    revalidatePath(\"/\", \"layout\");\n  }\n  return res;\n}\n\n/**\n * Sets the current session's password — the prompt completeAuthRedirectAction\n * triggers via needsPassword. Requires only a valid session, not a role: an\n * invited person's role is claimed as a side effect of getCachedViewer()\n * resolving them, which already happens independently of this.\n */\nexport async function setPasswordAction(\n  _prev: SetPasswordState,\n  formData: FormData,\n): Promise<SetPasswordState> {\n  const viewer = await getCachedViewer();\n  if (!viewer) return { success: false, error: \"Not signed in.\" };\n\n  const auth = getAuth();\n  if (!auth.setPassword) {\n    return { success: false, error: \"This site's auth provider does not support setting a password.\" };\n  }\n\n  const password = String(formData.get(\"password\") ?? \"\");\n  const res = await auth.setPassword(password);\n  if (res.success) {\n    const cookieStore = await cookies();\n    cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);\n    revalidatePath(\"/\", \"layout\");\n  }\n  return res;\n}\n\n/** Dismisses the set-password prompt without setting one — see Admin.tsx. */\nexport async function skipSetPasswordAction(): Promise<{ success: boolean }> {\n  const cookieStore = await cookies();\n  cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,SAAS,eAAe;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,YAAY,qCAAqC;AAkB1D,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAOhE,eAAsB,YACpB,SAC0B;AAC1B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,eAAsB,aAAa,KAAmC;AACpE,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,YAA0B;AAAA,IAC9B,SAAS,IAAI;AAAA,IACb,QAAQ,MAAM,cAAc;AAAA,IAC5B,MAAM,IAAI,MAAM;AAAA,IAChB,OAAO,IAAI;AAAA,EACb;AAEA,MAAI;AACF,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,MAAM,GAAG,YAAY,SAAS;AAC1C,QAAI,CAAC,IAAI,QAAS,QAAO;AAGzB,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0BAA0B,CAAC;AACzC,WAAO,EAAE,SAAS,OAAO,OAAO,yBAAyB;AAAA,EAC3D;AACF;AAMA,MAAM,cAAc,CAAC,aAAa,cAAc,cAAc,aAAa,YAAY;AACvF,MAAM,mBAAmB,KAAK,OAAO;AAMrC,eAAsB,kBAAkB,MAMtC;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,oCAAoC;AAAA,EACtE;AACA,MAAI,CAAC,YAAY,SAAS,KAAK,WAAW,GAAG;AAC3C,WAAO,EAAE,SAAS,OAAO,OAAO,gDAAgD;AAAA,EAClF;AACA,MAAI,EAAE,KAAK,OAAO,MAAM,KAAK,OAAO,kBAAkB;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B;AAAA,EAChE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,cAAc,GAAG,IAAI;AACrE,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,kCAAkC,CAAC;AAIjD,UAAM,SACJ,QAAQ,IAAI,aAAa,gBAAgB,aAAa,QAClD,IAAI,EAAE,OAAO,KACb;AACN,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B,MAAM,GAAG;AAAA,EACzE;AACF;AAEA,eAAsB,aAAiC;AACrD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO,CAAC;AACjC,SAAO,QAAQ,WAAW,MAAM,cAAc,CAAC;AACjD;AAIA,eAAsB,WAAgC;AAEpD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,UAAU,WAAW;AAC3B,SAAO,QAAQ,YAAY,MAAM,cAAc,CAAC;AAClD;AAEA,eAAsB,aACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAC5C,MAAI,CAAC,6BAA6B,KAAK,UAAU,GAAG;AAClD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AAEA,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,EAAE,OAAO,WAAW,CAAC;AACtE,MAAI,UAAU,WAAW,UAAU;AACjC,WAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,EACzE;AAIA,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,MAC7C,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,QAAS,QAAO;AAAA,EAC3B;AAEA,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,YAAY;AAEnB,UAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAAA,MAC7C,YAAY,GAAG,MAAM,cAAc,CAAC;AAAA,IACtC,CAAC;AACD,mBAAe,KAAK,QAAQ;AAC5B,WAAO,KAAK,UACR,EAAE,SAAS,KAAK,IAChB;AAAA,MACE,SAAS;AAAA,MACT,OAAO,uCAAuC,KAAK,KAAK;AAAA,IAC1D;AAAA,EACN;AAGA,MAAI;AACF,UAAM,iBAAiB,IAAI;AAAA,MACzB,OAAO;AAAA,MACP,MAAM,UAAU,QAAQ;AAAA,MACxB;AAAA,MACA,WAAW,OAAO,SAAS,OAAO;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,GAAG;AACV,YAAQ,MAAM,qCAAqC,CAAC;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAsB,iBACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ;AAAA,IAC7C,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAE/D,MAAI,OAAO,SAAS,WAAW,SAAS,SAAS;AAC/C,UAAM,QAAQ,MAAM,gBAAgB,QAAQ,OAAO,KAAK;AACxD,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,IAC7C,OAAO,OAAO;AAAA,IACd;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAsB,aAAa,OAAgC;AACjE,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAE5C,QAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,MAAI,MAAO,QAAO;AAElB,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ,UAAU;AACzD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAe,gBAAiC;AAC9C,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,QAAQ;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,OAAO,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,MAAM,KAAK;AAC3D,QAAM,QAAQ,EAAE,IAAI,mBAAmB,MAAM,KAAK,WAAW,WAAW,IAAI,SAAS;AACrF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAMA,eAAe,gBACb,QACA,OACwB;AACxB,QAAM,UAAU,WAAW;AAC3B,QAAM,MAAM,MAAM,QAAQ,YAAY,MAAM;AAC5C,QAAM,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO;AAEnD,MAAI,OAAO,UAAU,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIA,eAAsB,YACpB,OACA,UACsB;AACtB,QAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAChD,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AAEtD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,cAAc;AACtB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,KAAK,aAAa,OAAO,QAAQ;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,SAAS,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,MAAM,MAAM;AAChC;AAEA,eAAsB,eAA8C;AAClE,QAAM,OAAO,QAAQ;AACrB,QAAM,KAAK,OAAO;AASlB,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,WAAW,SAAS;AACvC,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAgBA,eAAsB,2BACpB,QACwE;AACxE,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,qBAAsB,QAAO,EAAE,SAAS,MAAM;AAExD,QAAM,MAAM,MAAM,KAAK,qBAAqB,MAAM;AAClD,MAAI,IAAI,SAAS;AACf,QAAI,IAAI,eAAe;AACrB,YAAM,cAAc,MAAM,QAAQ;AAClC,kBAAY,IAAI,WAAW,gBAAgB,QAAQ;AAAA,QACjD,MAAM;AAAA,QACN,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,mBAAe,KAAK,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAQA,eAAsB,kBACpB,OACA,UAC2B;AAC3B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAE9D,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,aAAa;AACrB,WAAO,EAAE,SAAS,OAAO,OAAO,iEAAiE;AAAA,EACnG;AAEA,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AACtD,QAAM,MAAM,MAAM,KAAK,YAAY,QAAQ;AAC3C,MAAI,IAAI,SAAS;AACf,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,OAAO,WAAW,cAAc;AAC5C,mBAAe,KAAK,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAGA,eAAsB,wBAAuD;AAC3E,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,WAAW,cAAc;AAC5C,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;","names":[]}

package/dist/server/wrapper.js

@@ -22,14 +22,19 @@ function withGuardrail(LayoutComponent, config) {
       loadPreloadedContent()
     ]);
     const auth = getAuth();
+    const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;
+    const isAuth = viewer !== null;
+    const needsPassword = cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === "true";
+    const isEditMode = needsPassword || (editCookie === "false" ? false : editCookie === "true" || isAuth);
     const state = {
       storage: getStorage() !== void 0,
       auth: {
         password: typeof auth.authenticate === "function",
         ...auth.signInUrl ? { signInUrl: auth.signInUrl } : {}
       },
-      isAuth: viewer !== null,
-      isEditMode: cookieStore.get(GR_COOKIES.EDIT_MODE)?.value === "true",
+      isAuth,
+      isEditMode,
+      needsPassword,
       siteId: await resolveSiteId(),
       role: viewer?.role ?? null,
       ...viewer?.email ? { email: viewer.email } : {}

package/dist/server/wrapper.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/wrapper.tsx"],"sourcesContent":["import React, { Suspense } from \"react\";\nimport { cookies } from \"next/headers\";\nimport {\n  configureGuardrail,\n  getAuth,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { loadPreloadedContent } from \"./loader\";\nimport type { GRConfig } from \"../core/adapter-types\";\nimport { GR_COOKIES } from \"../core/defs\";\nimport { GRailProvider } from \"../react/Provider\";\nimport { GRailAdmin } from \"../react/Admin\";\nimport type { GRState } from \"../core/types\";\n\n/**\n * Wraps a root layout so every route carries Guardrail's edit state and admin\n * chrome. Stays a Server Component: the provider below is the client boundary.\n */\nexport function withGuardrail<P extends object>(\n  LayoutComponent: React.ComponentType<P>,\n  config: GRConfig,\n) {\n  // Applied at module evaluation so the config is present as soon as anything\n  // imports the layout, and again per render because Next.js does not\n  // guarantee one shared module instance across its server contexts.\n  configureGuardrail(config);\n\n  return async function GuardrailLayout(props: P) {\n    configureGuardrail(config);\n\n    const cookieStore = await cookies();\n\n    // Verified against the auth provider, not inferred from a cookie. Loaded\n    // alongside the content preload: independent round trips, and the preload\n    // is shared with the page's own fields, so it costs them nothing extra.\n    const [viewer, content] = await Promise.all([\n      getCachedViewer(),\n      loadPreloadedContent(),\n    ]);\n\n    const auth = getAuth();\n\n    const state: GRState = {\n      storage: getStorage() !== undefined,\n      auth: {\n        password: typeof auth.authenticate === \"function\",\n        ...(auth.signInUrl ? { signInUrl: auth.signInUrl } : {}),\n      },\n      isAuth: viewer !== null,\n      isEditMode: cookieStore.get(GR_COOKIES.EDIT_MODE)?.value === \"true\",\n      siteId: await resolveSiteId(),\n      role: viewer?.role ?? null,\n      ...(viewer?.email ? { email: viewer.email } : {}),\n    };\n\n    return (\n      <GRailProvider state={state} content={content}>\n        <LayoutComponent {...props} />\n        <Suspense fallback={null}>\n          <GRailAdmin toolbarExtra={config.toolbarExtra} />\n        </Suspense>\n      </GRailProvider>\n    );\n  };\n}\n"],"mappings":"AA0DM,SACE,KADF;AA1DN,OAAO,SAAS,gBAAgB;AAChC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AAErC,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAOpB,SAAS,cACd,iBACA,QACA;AAIA,qBAAmB,MAAM;AAEzB,SAAO,eAAe,gBAAgB,OAAU;AAC9C,uBAAmB,MAAM;AAEzB,UAAM,cAAc,MAAM,QAAQ;AAKlC,UAAM,CAAC,QAAQ,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,IACvB,CAAC;AAED,UAAM,OAAO,QAAQ;AAErB,UAAM,QAAiB;AAAA,MACrB,SAAS,WAAW,MAAM;AAAA,MAC1B,MAAM;AAAA,QACJ,UAAU,OAAO,KAAK,iBAAiB;AAAA,QACvC,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACxD;AAAA,MACA,QAAQ,WAAW;AAAA,MACnB,YAAY,YAAY,IAAI,WAAW,SAAS,GAAG,UAAU;AAAA,MAC7D,QAAQ,MAAM,cAAc;AAAA,MAC5B,MAAM,QAAQ,QAAQ;AAAA,MACtB,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IACjD;AAEA,WACE,qBAAC,iBAAc,OAAc,SAC3B;AAAA,0BAAC,mBAAiB,GAAG,OAAO;AAAA,MAC5B,oBAAC,YAAS,UAAU,MAClB,8BAAC,cAAW,cAAc,OAAO,cAAc,GACjD;AAAA,OACF;AAAA,EAEJ;AACF;","names":[]}
+{"version":3,"sources":["../../src/server/wrapper.tsx"],"sourcesContent":["import React, { Suspense } from \"react\";\nimport { cookies } from \"next/headers\";\nimport {\n  configureGuardrail,\n  getAuth,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { loadPreloadedContent } from \"./loader\";\nimport type { GRConfig } from \"../core/adapter-types\";\nimport { GR_COOKIES } from \"../core/defs\";\nimport { GRailProvider } from \"../react/Provider\";\nimport { GRailAdmin } from \"../react/Admin\";\nimport type { GRState } from \"../core/types\";\n\n/**\n * Wraps a root layout so every route carries Guardrail's edit state and admin\n * chrome. Stays a Server Component: the provider below is the client boundary.\n */\nexport function withGuardrail<P extends object>(\n  LayoutComponent: React.ComponentType<P>,\n  config: GRConfig,\n) {\n  // Applied at module evaluation so the config is present as soon as anything\n  // imports the layout, and again per render because Next.js does not\n  // guarantee one shared module instance across its server contexts.\n  configureGuardrail(config);\n\n  return async function GuardrailLayout(props: P) {\n    configureGuardrail(config);\n\n    const cookieStore = await cookies();\n\n    // Verified against the auth provider, not inferred from a cookie. Loaded\n    // alongside the content preload: independent round trips, and the preload\n    // is shared with the page's own fields, so it costs them nothing extra.\n    const [viewer, content] = await Promise.all([\n      getCachedViewer(),\n      loadPreloadedContent(),\n    ]);\n\n    const auth = getAuth();\n\n    // \"false\" is an explicit, deliberate suppression (?edit=false while still\n    // signed in, to preview without chrome) and wins outright. Otherwise, a\n    // real session is enough on its own — an authenticated editor's chrome\n    // persists for as long as that session does, with no separate cookie\n    // timer to fall out of sync with it. \"true\" only matters for someone not\n    // yet authenticated: a short-lived grace window (see GR_EDIT_MODE_TTL_SECONDS)\n    // to actually reach the sign-in form, not a standing invitation — the\n    // previous design kept this cookie alive indefinitely once set, which\n    // meant a stray copy of it kept showing the sign-in bar to whoever's\n    // browser it was sitting in, for as long as that browser stayed open.\n    const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;\n    const isAuth = viewer !== null;\n    // Set by completeAuthRedirectAction the moment an invite/recovery link\n    // finishes — forces chrome on regardless of the edit-mode cookie, since\n    // the whole point is to show the set-password prompt right away, not\n    // require also having ?edit=true or an unsuppressed cookie.\n    const needsPassword = cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === \"true\";\n    const isEditMode =\n      needsPassword || (editCookie === \"false\" ? false : editCookie === \"true\" || isAuth);\n\n    const state: GRState = {\n      storage: getStorage() !== undefined,\n      auth: {\n        password: typeof auth.authenticate === \"function\",\n        ...(auth.signInUrl ? { signInUrl: auth.signInUrl } : {}),\n      },\n      isAuth,\n      isEditMode,\n      needsPassword,\n      siteId: await resolveSiteId(),\n      role: viewer?.role ?? null,\n      ...(viewer?.email ? { email: viewer.email } : {}),\n    };\n\n    return (\n      <GRailProvider state={state} content={content}>\n        <LayoutComponent {...props} />\n        <Suspense fallback={null}>\n          <GRailAdmin toolbarExtra={config.toolbarExtra} />\n        </Suspense>\n      </GRailProvider>\n    );\n  };\n}\n"],"mappings":"AA+EM,SACE,KADF;AA/EN,OAAO,SAAS,gBAAgB;AAChC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AAErC,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAOpB,SAAS,cACd,iBACA,QACA;AAIA,qBAAmB,MAAM;AAEzB,SAAO,eAAe,gBAAgB,OAAU;AAC9C,uBAAmB,MAAM;AAEzB,UAAM,cAAc,MAAM,QAAQ;AAKlC,UAAM,CAAC,QAAQ,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,IACvB,CAAC;AAED,UAAM,OAAO,QAAQ;AAYrB,UAAM,aAAa,YAAY,IAAI,WAAW,SAAS,GAAG;AAC1D,UAAM,SAAS,WAAW;AAK1B,UAAM,gBAAgB,YAAY,IAAI,WAAW,cAAc,GAAG,UAAU;AAC5E,UAAM,aACJ,kBAAkB,eAAe,UAAU,QAAQ,eAAe,UAAU;AAE9E,UAAM,QAAiB;AAAA,MACrB,SAAS,WAAW,MAAM;AAAA,MAC1B,MAAM;AAAA,QACJ,UAAU,OAAO,KAAK,iBAAiB;AAAA,QACvC,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,MAAM,cAAc;AAAA,MAC5B,MAAM,QAAQ,QAAQ;AAAA,MACtB,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IACjD;AAEA,WACE,qBAAC,iBAAc,OAAc,SAC3B;AAAA,0BAAC,mBAAiB,GAAG,OAAO;AAAA,MAC5B,oBAAC,YAAS,UAAU,MAClB,8BAAC,cAAW,cAAc,OAAO,cAAc,GACjD;AAAA,OACF;AAAA,EAEJ;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guard-rail/core",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Lightweight inline content editing for developer-owned Next.js sites.",
   "license": "ISC",
   "type": "module",
@@ -32,7 +32,8 @@
     "scripts"
   ],
   "bin": {
-    "guardrail-seed-user": "dist/cli/seed-user.js"
+    "guardrail-seed-user": "dist/cli/seed-user.js",
+    "guardrail-init-db": "dist/cli/init-db.js"
   },
   "publishConfig": {
     "access": "public"

package/scripts/postinstall.mjs

@@ -30,10 +30,10 @@ Guardrail installed. Next steps:
 1. Set up the database (skip both if this Supabase project already has
    Guardrail applied for another site — see "Many sites, one Supabase
    project" in the README):
-     - Copy node_modules/@guard-rail/core/supabase/migrations/*.sql into
-       your own supabase/migrations/, then \`supabase db push\`.
-     - Add "guardrail" under Settings > API > Exposed schemas in the
-       Supabase dashboard.
+     - npx guardrail-init-db --push
+     - If that project is hosted (not local Docker), also add "guardrail"
+       under Settings > API > Exposed schemas in the Supabase dashboard —
+       config.toml only covers local dev.
 
 2. Wrap your root layout with withGuardrail and mark fields with <GRail>.
    Full guide: https://www.npmjs.com/package/@guard-rail/core