@guard-rail/core 0.3.0 → 0.6.0

package/dist/react/Syncer.js

@@ -1,17 +1,19 @@
 "use client";
 import { useEffect } from "react";
 import { useSearchParams } from "next/navigation";
-import { GR_COOKIES } from "../core/defs";
+import { GR_COOKIES, GR_EDIT_MODE_TTL_SECONDS } from "../core/defs";
 function EditSyncer() {
   const searchParams = useSearchParams();
   useEffect(() => {
     const edit = searchParams.get("edit");
-    const hasCookie = document.cookie.includes(`${GR_COOKIES.EDIT_MODE}=true`);
-    if (edit === "true" && !hasCookie) {
-      document.cookie = `${GR_COOKIES.EDIT_MODE}=true; path=/; SameSite=Lax`;
+    const current = document.cookie.match(
+      new RegExp(`(?:^|; )${GR_COOKIES.EDIT_MODE}=([^;]*)`)
+    )?.[1];
+    if (edit === "true" && current !== "true") {
+      document.cookie = `${GR_COOKIES.EDIT_MODE}=true; path=/; max-age=${GR_EDIT_MODE_TTL_SECONDS}; SameSite=Lax`;
       window.location.reload();
-    } else if (edit === "false" && hasCookie) {
-      document.cookie = `${GR_COOKIES.EDIT_MODE}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT`;
+    } else if (edit === "false" && current !== "false") {
+      document.cookie = `${GR_COOKIES.EDIT_MODE}=false; path=/; max-age=${GR_EDIT_MODE_TTL_SECONDS}; SameSite=Lax`;
       window.location.reload();
     }
   }, [searchParams]);

package/dist/react/Syncer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/Syncer.tsx"],"sourcesContent":["\"use client\";\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { GR_COOKIES } from \"../core/defs\";\n\n/**\n * Turns edit mode on from the URL. Off is deliberately not symmetrical with\n * on: the cookie is the actual state (withGuardrail reads it fresh from\n * cookies() on every navigation, which is why edit mode survives clicking\n * through the site at all), and ?edit=true is a one-time switch, not a value\n * that has to keep appearing on every URL to hold that state.\n *\n * A page that simply doesn't mention `edit` — which is every normal link on\n * the site, including a repeater's card linking to its own route — must\n * leave the cookie alone. Treating \"no param\" as \"turn it off\" was the actual\n * bug: it silently ended the edit session on the very first click to a page\n * that didn't happen to carry the query string. Only an explicit\n * ?edit=false turns it off from the URL; Log out is the normal way to end it.\n */\nexport function EditSyncer() {\n  const searchParams = useSearchParams();\n\n  useEffect(() => {\n    const edit = searchParams.get(\"edit\");\n    const hasCookie = document.cookie.includes(`${GR_COOKIES.EDIT_MODE}=true`);\n\n    if (edit === \"true\" && !hasCookie) {\n      document.cookie = `${GR_COOKIES.EDIT_MODE}=true; path=/; SameSite=Lax`;\n      window.location.reload();\n    } else if (edit === \"false\" && hasCookie) {\n      document.cookie = `${GR_COOKIES.EDIT_MODE}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n      window.location.reload();\n    }\n  }, [searchParams]);\n\n  return null;\n}\n"],"mappings":";AAEA,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAgBpB,SAAS,aAAa;AAC3B,QAAM,eAAe,gBAAgB;AAErC,YAAU,MAAM;AACd,UAAM,OAAO,aAAa,IAAI,MAAM;AACpC,UAAM,YAAY,SAAS,OAAO,SAAS,GAAG,WAAW,SAAS,OAAO;AAEzE,QAAI,SAAS,UAAU,CAAC,WAAW;AACjC,eAAS,SAAS,GAAG,WAAW,SAAS;AACzC,aAAO,SAAS,OAAO;AAAA,IACzB,WAAW,SAAS,WAAW,WAAW;AACxC,eAAS,SAAS,GAAG,WAAW,SAAS;AACzC,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/react/Syncer.tsx"],"sourcesContent":["\"use client\";\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { GR_COOKIES, GR_EDIT_MODE_TTL_SECONDS } from \"../core/defs\";\n\n/**\n * Turns edit mode on (or explicitly off) from the URL, via a short-lived\n * cookie rather than a persistent one — see the comment on GR_COOKIES for\n * why that boundary moved here. ?edit=true is a one-time switch, not a value\n * that has to keep appearing on every URL to hold that state, but \"holding\n * that state\" now means \"for the next ~10 minutes, or until real auth takes\n * over,\" not indefinitely.\n *\n * A page that simply doesn't mention `edit` — which is every normal link on\n * the site, including a repeater's card linking to its own route — must\n * leave the cookie alone. Treating \"no param\" as \"turn it off\" was a past\n * bug: it silently ended the edit session on the very first click to a page\n * that didn't happen to carry the query string. Only an explicit ?edit=false\n * turns it off from the URL; logging out is the normal way to end a real\n * session (and, unlike this cookie, actually needs to — see logoutAction).\n */\nexport function EditSyncer() {\n  const searchParams = useSearchParams();\n\n  useEffect(() => {\n    const edit = searchParams.get(\"edit\");\n    const current = document.cookie.match(\n      new RegExp(`(?:^|; )${GR_COOKIES.EDIT_MODE}=([^;]*)`),\n    )?.[1];\n\n    if (edit === \"true\" && current !== \"true\") {\n      document.cookie = `${GR_COOKIES.EDIT_MODE}=true; path=/; max-age=${GR_EDIT_MODE_TTL_SECONDS}; SameSite=Lax`;\n      window.location.reload();\n    } else if (edit === \"false\" && current !== \"false\") {\n      document.cookie = `${GR_COOKIES.EDIT_MODE}=false; path=/; max-age=${GR_EDIT_MODE_TTL_SECONDS}; SameSite=Lax`;\n      window.location.reload();\n    }\n  }, [searchParams]);\n\n  return null;\n}\n"],"mappings":";AAEA,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,YAAY,gCAAgC;AAkB9C,SAAS,aAAa;AAC3B,QAAM,eAAe,gBAAgB;AAErC,YAAU,MAAM;AACd,UAAM,OAAO,aAAa,IAAI,MAAM;AACpC,UAAM,UAAU,SAAS,OAAO;AAAA,MAC9B,IAAI,OAAO,WAAW,WAAW,SAAS,UAAU;AAAA,IACtD,IAAI,CAAC;AAEL,QAAI,SAAS,UAAU,YAAY,QAAQ;AACzC,eAAS,SAAS,GAAG,WAAW,SAAS,0BAA0B,wBAAwB;AAC3F,aAAO,SAAS,OAAO;AAAA,IACzB,WAAW,SAAS,WAAW,YAAY,SAAS;AAClD,eAAS,SAAS,GAAG,WAAW,SAAS,2BAA2B,wBAAwB;AAC5F,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,SAAO;AACT;","names":[]}

package/dist/react/useAnchorRect.d.ts

@@ -11,7 +11,23 @@ interface AnchorRect {
  *
  * Listens on the capture phase so scrolling inside any ancestor container
  * repositions the chrome, not just window scroll.
+ *
+ * Two things keep this cheap when many elements track at once (every image
+ * field does, for its idle marker, for as long as edit mode is on — not just
+ * the one actively being edited):
+ *
+ * - Measurement is coalesced to one requestAnimationFrame per scroll/resize
+ *   burst, not one per raw event. A scroll can fire far more of those than
+ *   the page ever paints, so N tracked elements without this meant N
+ *   getBoundingClientRect() calls and N re-renders per event, not per frame.
+ * - `gateByVisibility` skips attaching any listener at all — scroll, resize,
+ *   or the ResizeObserver — for an element nowhere near the viewport, via
+ *   IntersectionObserver. A long page with many editable images then only
+ *   pays for the handful actually in view at a given scroll position, not
+ *   all of them.
  */
-declare function useAnchorRect(ref: RefObject<HTMLElement | null>, active: boolean): AnchorRect | null;
+declare function useAnchorRect(ref: RefObject<HTMLElement | null>, active: boolean, options?: {
+    gateByVisibility?: boolean;
+}): AnchorRect | null;
 
 export { type AnchorRect, useAnchorRect };

package/dist/react/useAnchorRect.js

@@ -1,30 +1,58 @@
 "use client";
-import { useCallback, useEffect, useState } from "react";
-function useAnchorRect(ref, active) {
+import { useCallback, useEffect, useRef, useState } from "react";
+function useAnchorRect(ref, active, options = {}) {
+  const { gateByVisibility = false } = options;
   const [rect, setRect] = useState(null);
+  const rafRef = useRef(null);
   const measure = useCallback(() => {
     const el = ref.current;
     if (!el) return;
     const r = el.getBoundingClientRect();
     setRect({ top: r.top, left: r.left, bottom: r.bottom, width: r.width });
   }, [ref]);
+  const scheduleMeasure = useCallback(() => {
+    if (rafRef.current !== null) return;
+    rafRef.current = requestAnimationFrame(() => {
+      rafRef.current = null;
+      measure();
+    });
+  }, [measure]);
+  const [visible, setVisible] = useState(!gateByVisibility);
   useEffect(() => {
-    if (!active) {
+    if (!active || !gateByVisibility) return;
+    const el = ref.current;
+    if (!el || typeof IntersectionObserver === "undefined") {
+      setVisible(true);
+      return;
+    }
+    const io = new IntersectionObserver(
+      (entries) => setVisible(entries[0]?.isIntersecting ?? false),
+      { rootMargin: "200px" }
+    );
+    io.observe(el);
+    return () => io.disconnect();
+  }, [active, gateByVisibility, ref]);
+  useEffect(() => {
+    if (!active || gateByVisibility && !visible) {
       setRect(null);
       return;
     }
     measure();
-    window.addEventListener("scroll", measure, true);
-    window.addEventListener("resize", measure);
-    const observer = typeof ResizeObserver !== "undefined" ? new ResizeObserver(measure) : null;
+    window.addEventListener("scroll", scheduleMeasure, true);
+    window.addEventListener("resize", scheduleMeasure);
+    const observer = typeof ResizeObserver !== "undefined" ? new ResizeObserver(scheduleMeasure) : null;
     if (observer && ref.current) observer.observe(ref.current);
     if (observer) observer.observe(document.body);
     return () => {
-      window.removeEventListener("scroll", measure, true);
-      window.removeEventListener("resize", measure);
+      window.removeEventListener("scroll", scheduleMeasure, true);
+      window.removeEventListener("resize", scheduleMeasure);
       observer?.disconnect();
+      if (rafRef.current !== null) {
+        cancelAnimationFrame(rafRef.current);
+        rafRef.current = null;
+      }
     };
-  }, [active, measure, ref]);
+  }, [active, gateByVisibility, visible, measure, scheduleMeasure, ref]);
   return rect;
 }
 export {

package/dist/react/useAnchorRect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/useAnchorRect.ts"],"sourcesContent":["\"use client\";\n\nimport { useCallback, useEffect, useState, type RefObject } from \"react\";\n\nexport interface AnchorRect {\n  top: number;\n  left: number;\n  bottom: number;\n  width: number;\n}\n\n/**\n * Tracks an element's viewport rect so editing chrome can sit against it.\n *\n * Listens on the capture phase so scrolling inside any ancestor container\n * repositions the chrome, not just window scroll.\n */\nexport function useAnchorRect(\n  ref: RefObject<HTMLElement | null>,\n  active: boolean,\n): AnchorRect | null {\n  const [rect, setRect] = useState<AnchorRect | null>(null);\n\n  const measure = useCallback(() => {\n    const el = ref.current;\n    if (!el) return;\n    const r = el.getBoundingClientRect();\n    setRect({ top: r.top, left: r.left, bottom: r.bottom, width: r.width });\n  }, [ref]);\n\n  useEffect(() => {\n    if (!active) {\n      setRect(null);\n      return;\n    }\n\n    measure();\n    window.addEventListener(\"scroll\", measure, true);\n    window.addEventListener(\"resize\", measure);\n\n    // Catches layout shifts from the edit itself (text reflowing the element).\n    const observer =\n      typeof ResizeObserver !== \"undefined\" ? new ResizeObserver(measure) : null;\n    if (observer && ref.current) observer.observe(ref.current);\n    // Content changing size above or beside the element moves it without\n    // resizing it, which observing the element alone never sees. The body's\n    // own height changes in most of those cases.\n    if (observer) observer.observe(document.body);\n\n    return () => {\n      window.removeEventListener(\"scroll\", measure, true);\n      window.removeEventListener(\"resize\", measure);\n      observer?.disconnect();\n    };\n  }, [active, measure, ref]);\n\n  return rect;\n}\n"],"mappings":";AAEA,SAAS,aAAa,WAAW,gBAAgC;AAe1D,SAAS,cACd,KACA,QACmB;AACnB,QAAM,CAAC,MAAM,OAAO,IAAI,SAA4B,IAAI;AAExD,QAAM,UAAU,YAAY,MAAM;AAChC,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,GAAI;AACT,UAAM,IAAI,GAAG,sBAAsB;AACnC,YAAQ,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,CAAC;AAAA,EACxE,GAAG,CAAC,GAAG,CAAC;AAER,YAAU,MAAM;AACd,QAAI,CAAC,QAAQ;AACX,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,YAAQ;AACR,WAAO,iBAAiB,UAAU,SAAS,IAAI;AAC/C,WAAO,iBAAiB,UAAU,OAAO;AAGzC,UAAM,WACJ,OAAO,mBAAmB,cAAc,IAAI,eAAe,OAAO,IAAI;AACxE,QAAI,YAAY,IAAI,QAAS,UAAS,QAAQ,IAAI,OAAO;AAIzD,QAAI,SAAU,UAAS,QAAQ,SAAS,IAAI;AAE5C,WAAO,MAAM;AACX,aAAO,oBAAoB,UAAU,SAAS,IAAI;AAClD,aAAO,oBAAoB,UAAU,OAAO;AAC5C,gBAAU,WAAW;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,QAAQ,SAAS,GAAG,CAAC;AAEzB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/react/useAnchorRect.ts"],"sourcesContent":["\"use client\";\n\nimport { useCallback, useEffect, useRef, useState, type RefObject } from \"react\";\n\nexport interface AnchorRect {\n  top: number;\n  left: number;\n  bottom: number;\n  width: number;\n}\n\n/**\n * Tracks an element's viewport rect so editing chrome can sit against it.\n *\n * Listens on the capture phase so scrolling inside any ancestor container\n * repositions the chrome, not just window scroll.\n *\n * Two things keep this cheap when many elements track at once (every image\n * field does, for its idle marker, for as long as edit mode is on — not just\n * the one actively being edited):\n *\n * - Measurement is coalesced to one requestAnimationFrame per scroll/resize\n *   burst, not one per raw event. A scroll can fire far more of those than\n *   the page ever paints, so N tracked elements without this meant N\n *   getBoundingClientRect() calls and N re-renders per event, not per frame.\n * - `gateByVisibility` skips attaching any listener at all — scroll, resize,\n *   or the ResizeObserver — for an element nowhere near the viewport, via\n *   IntersectionObserver. A long page with many editable images then only\n *   pays for the handful actually in view at a given scroll position, not\n *   all of them.\n */\nexport function useAnchorRect(\n  ref: RefObject<HTMLElement | null>,\n  active: boolean,\n  options: { gateByVisibility?: boolean } = {},\n): AnchorRect | null {\n  const { gateByVisibility = false } = options;\n  const [rect, setRect] = useState<AnchorRect | null>(null);\n  const rafRef = useRef<number | null>(null);\n\n  const measure = useCallback(() => {\n    const el = ref.current;\n    if (!el) return;\n    const r = el.getBoundingClientRect();\n    setRect({ top: r.top, left: r.left, bottom: r.bottom, width: r.width });\n  }, [ref]);\n\n  const scheduleMeasure = useCallback(() => {\n    if (rafRef.current !== null) return;\n    rafRef.current = requestAnimationFrame(() => {\n      rafRef.current = null;\n      measure();\n    });\n  }, [measure]);\n\n  const [visible, setVisible] = useState(!gateByVisibility);\n\n  useEffect(() => {\n    if (!active || !gateByVisibility) return;\n    const el = ref.current;\n    if (!el || typeof IntersectionObserver === \"undefined\") {\n      setVisible(true);\n      return;\n    }\n    // A margin outside the viewport, not just inside it — so tracking (and\n    // the marker) is already live the instant an image scrolls into view,\n    // not a frame behind.\n    const io = new IntersectionObserver(\n      (entries) => setVisible(entries[0]?.isIntersecting ?? false),\n      { rootMargin: \"200px\" },\n    );\n    io.observe(el);\n    return () => io.disconnect();\n  }, [active, gateByVisibility, ref]);\n\n  useEffect(() => {\n    if (!active || (gateByVisibility && !visible)) {\n      setRect(null);\n      return;\n    }\n\n    measure();\n    window.addEventListener(\"scroll\", scheduleMeasure, true);\n    window.addEventListener(\"resize\", scheduleMeasure);\n\n    // Catches layout shifts from the edit itself (text reflowing the element).\n    const observer =\n      typeof ResizeObserver !== \"undefined\" ? new ResizeObserver(scheduleMeasure) : null;\n    if (observer && ref.current) observer.observe(ref.current);\n    // Content changing size above or beside the element moves it without\n    // resizing it, which observing the element alone never sees. The body's\n    // own height changes in most of those cases.\n    if (observer) observer.observe(document.body);\n\n    return () => {\n      window.removeEventListener(\"scroll\", scheduleMeasure, true);\n      window.removeEventListener(\"resize\", scheduleMeasure);\n      observer?.disconnect();\n      if (rafRef.current !== null) {\n        cancelAnimationFrame(rafRef.current);\n        rafRef.current = null;\n      }\n    };\n  }, [active, gateByVisibility, visible, measure, scheduleMeasure, ref]);\n\n  return rect;\n}\n"],"mappings":";AAEA,SAAS,aAAa,WAAW,QAAQ,gBAAgC;AA6BlE,SAAS,cACd,KACA,QACA,UAA0C,CAAC,GACxB;AACnB,QAAM,EAAE,mBAAmB,MAAM,IAAI;AACrC,QAAM,CAAC,MAAM,OAAO,IAAI,SAA4B,IAAI;AACxD,QAAM,SAAS,OAAsB,IAAI;AAEzC,QAAM,UAAU,YAAY,MAAM;AAChC,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,GAAI;AACT,UAAM,IAAI,GAAG,sBAAsB;AACnC,YAAQ,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,CAAC;AAAA,EACxE,GAAG,CAAC,GAAG,CAAC;AAER,QAAM,kBAAkB,YAAY,MAAM;AACxC,QAAI,OAAO,YAAY,KAAM;AAC7B,WAAO,UAAU,sBAAsB,MAAM;AAC3C,aAAO,UAAU;AACjB,cAAQ;AAAA,IACV,CAAC;AAAA,EACH,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,CAAC,gBAAgB;AAExD,YAAU,MAAM;AACd,QAAI,CAAC,UAAU,CAAC,iBAAkB;AAClC,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,MAAM,OAAO,yBAAyB,aAAa;AACtD,iBAAW,IAAI;AACf;AAAA,IACF;AAIA,UAAM,KAAK,IAAI;AAAA,MACb,CAAC,YAAY,WAAW,QAAQ,CAAC,GAAG,kBAAkB,KAAK;AAAA,MAC3D,EAAE,YAAY,QAAQ;AAAA,IACxB;AACA,OAAG,QAAQ,EAAE;AACb,WAAO,MAAM,GAAG,WAAW;AAAA,EAC7B,GAAG,CAAC,QAAQ,kBAAkB,GAAG,CAAC;AAElC,YAAU,MAAM;AACd,QAAI,CAAC,UAAW,oBAAoB,CAAC,SAAU;AAC7C,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,YAAQ;AACR,WAAO,iBAAiB,UAAU,iBAAiB,IAAI;AACvD,WAAO,iBAAiB,UAAU,eAAe;AAGjD,UAAM,WACJ,OAAO,mBAAmB,cAAc,IAAI,eAAe,eAAe,IAAI;AAChF,QAAI,YAAY,IAAI,QAAS,UAAS,QAAQ,IAAI,OAAO;AAIzD,QAAI,SAAU,UAAS,QAAQ,SAAS,IAAI;AAE5C,WAAO,MAAM;AACX,aAAO,oBAAoB,UAAU,iBAAiB,IAAI;AAC1D,aAAO,oBAAoB,UAAU,eAAe;AACpD,gBAAU,WAAW;AACrB,UAAI,OAAO,YAAY,MAAM;AAC3B,6BAAqB,OAAO,OAAO;AACnC,eAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,QAAQ,kBAAkB,SAAS,SAAS,iBAAiB,GAAG,CAAC;AAErE,SAAO;AACT;","names":[]}

package/dist/server/access.d.ts

@@ -0,0 +1,76 @@
+import { GRRole, GRViewer } from '../core/types.js';
+import 'react';
+
+/**
+ * Role checks, server-side only.
+ *
+ * Deliberately NOT in a "use server" file: every export of one of those is a
+ * callable Server Action endpoint, which is the wrong shape for an
+ * authorization helper — it should only ever run inside the server code that
+ * calls it.
+ *
+ * The client's copy of the role (useGRail().role) decides what to *show*; it
+ * never decides what is *allowed*. A hidden button is not authorization, so
+ * any Server Action behind a custom admin UI must call one of these itself.
+ */
+/**
+ * Returns the signed-in viewer if their role is in `allowed`, otherwise null.
+ * The building block for the two helpers below; reach for this directly only
+ * when you need the viewer itself (their email, say), not just a yes/no.
+ */
+declare function requireRole(allowed: readonly GRRole[]): Promise<GRViewer | null>;
+/** True for a signed-in admin of this site — team management, and everything an editor can do. */
+declare function isAdmin(): Promise<boolean>;
+/**
+ * True for anyone who may edit this site's content: an editor, or an admin
+ * (admins can do everything editors can). The check for a custom drawer's
+ * Server Action that changes content. Use isAdmin() instead for anything that
+ * touches the team.
+ */
+declare function isEditor(): Promise<boolean>;
+/**
+ * True when this viewer may edit AND the site is currently in edit mode — the
+ * one check for "should I show editing UI / do edit-only work right now."
+ * Admin vs editor doesn't matter; use isAdmin() when it does.
+ *
+ * For a custom drawer's trigger rendered in a Server Component. In a Client
+ * Component, read `canEdit` from useGRail() instead — same answer, same rule.
+ * Don't use it as the only authorization on a Server Action: edit mode is a
+ * display preference (a cookie the visitor controls), so the action should
+ * call isEditor() — this answers "show it," that answers "allow it."
+ *
+ * Reads cookies, which makes the calling route dynamic — nothing new in
+ * practice, since withGuardrail() already does the same in the root layout.
+ */
+declare function canEdit(): Promise<boolean>;
+/**
+ * The one definition of "is the site in edit mode," shared by withGuardrail()
+ * (which hands it to the client as useGRail().isEditMode) and canEdit() so the
+ * two can't drift apart.
+ *
+ * "false" is an explicit, deliberate suppression (?edit=false while still
+ * signed in, to preview without chrome) and wins outright. Otherwise, a real
+ * session is enough on its own — an authenticated editor's chrome persists for
+ * as long as that session does, with no separate cookie timer to fall out of
+ * sync with it. "true" only matters for someone not yet authenticated: a
+ * short-lived grace window (see GR_EDIT_MODE_TTL_SECONDS) to actually reach
+ * the sign-in form, not a standing invitation — the previous design kept this
+ * cookie alive indefinitely once set, which meant a stray copy of it kept
+ * showing the sign-in bar to whoever's browser it was sitting in, for as long
+ * as that browser stayed open.
+ *
+ * needsPassword is set by completeAuthRedirectAction the moment an
+ * invite/recovery link finishes — it forces chrome on regardless of the
+ * edit-mode cookie, since the whole point is to show the set-password prompt
+ * right away, not require also having ?edit=true or an unsuppressed cookie.
+ */
+declare function resolveEditMode(viewer: GRViewer | null, cookieStore: {
+    get(name: string): {
+        value: string;
+    } | undefined;
+}): {
+    isEditMode: boolean;
+    needsPassword: boolean;
+};
+
+export { canEdit, isAdmin, isEditor, requireRole, resolveEditMode };

package/dist/server/access.js

@@ -0,0 +1,33 @@
+import { cookies } from "next/headers";
+import { getCachedViewer } from "./session";
+import { GR_COOKIES } from "../core/defs";
+async function requireRole(allowed) {
+  const viewer = await getCachedViewer();
+  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;
+  return viewer;
+}
+async function isAdmin() {
+  return await requireRole(["admin"]) !== null;
+}
+async function isEditor() {
+  return await requireRole(["admin", "editor"]) !== null;
+}
+async function canEdit() {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return false;
+  return resolveEditMode(viewer, await cookies()).isEditMode;
+}
+function resolveEditMode(viewer, cookieStore) {
+  const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;
+  const needsPassword = cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === "true";
+  const isEditMode = needsPassword || (editCookie === "false" ? false : editCookie === "true" || viewer !== null);
+  return { isEditMode, needsPassword };
+}
+export {
+  canEdit,
+  isAdmin,
+  isEditor,
+  requireRole,
+  resolveEditMode
+};
+//# sourceMappingURL=access.js.map

package/dist/server/access.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/access.ts"],"sourcesContent":["import { cookies } from \"next/headers\";\nimport { getCachedViewer } from \"./session\";\nimport { GR_COOKIES } from \"../core/defs\";\nimport type { GRRole, GRViewer } from \"../core/types\";\n\n/**\n * Role checks, server-side only.\n *\n * Deliberately NOT in a \"use server\" file: every export of one of those is a\n * callable Server Action endpoint, which is the wrong shape for an\n * authorization helper — it should only ever run inside the server code that\n * calls it.\n *\n * The client's copy of the role (useGRail().role) decides what to *show*; it\n * never decides what is *allowed*. A hidden button is not authorization, so\n * any Server Action behind a custom admin UI must call one of these itself.\n */\n\n/**\n * Returns the signed-in viewer if their role is in `allowed`, otherwise null.\n * The building block for the two helpers below; reach for this directly only\n * when you need the viewer itself (their email, say), not just a yes/no.\n */\nexport async function requireRole(\n  allowed: readonly GRRole[],\n): Promise<GRViewer | null> {\n  const viewer = await getCachedViewer();\n  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;\n  return viewer;\n}\n\n/** True for a signed-in admin of this site — team management, and everything an editor can do. */\nexport async function isAdmin(): Promise<boolean> {\n  return (await requireRole([\"admin\"])) !== null;\n}\n\n/**\n * True for anyone who may edit this site's content: an editor, or an admin\n * (admins can do everything editors can). The check for a custom drawer's\n * Server Action that changes content. Use isAdmin() instead for anything that\n * touches the team.\n */\nexport async function isEditor(): Promise<boolean> {\n  return (await requireRole([\"admin\", \"editor\"])) !== null;\n}\n\n/**\n * True when this viewer may edit AND the site is currently in edit mode — the\n * one check for \"should I show editing UI / do edit-only work right now.\"\n * Admin vs editor doesn't matter; use isAdmin() when it does.\n *\n * For a custom drawer's trigger rendered in a Server Component. In a Client\n * Component, read `canEdit` from useGRail() instead — same answer, same rule.\n * Don't use it as the only authorization on a Server Action: edit mode is a\n * display preference (a cookie the visitor controls), so the action should\n * call isEditor() — this answers \"show it,\" that answers \"allow it.\"\n *\n * Reads cookies, which makes the calling route dynamic — nothing new in\n * practice, since withGuardrail() already does the same in the root layout.\n */\nexport async function canEdit(): Promise<boolean> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return false;\n  return resolveEditMode(viewer, await cookies()).isEditMode;\n}\n\n/**\n * The one definition of \"is the site in edit mode,\" shared by withGuardrail()\n * (which hands it to the client as useGRail().isEditMode) and canEdit() so the\n * two can't drift apart.\n *\n * \"false\" is an explicit, deliberate suppression (?edit=false while still\n * signed in, to preview without chrome) and wins outright. Otherwise, a real\n * session is enough on its own — an authenticated editor's chrome persists for\n * as long as that session does, with no separate cookie timer to fall out of\n * sync with it. \"true\" only matters for someone not yet authenticated: a\n * short-lived grace window (see GR_EDIT_MODE_TTL_SECONDS) to actually reach\n * the sign-in form, not a standing invitation — the previous design kept this\n * cookie alive indefinitely once set, which meant a stray copy of it kept\n * showing the sign-in bar to whoever's browser it was sitting in, for as long\n * as that browser stayed open.\n *\n * needsPassword is set by completeAuthRedirectAction the moment an\n * invite/recovery link finishes — it forces chrome on regardless of the\n * edit-mode cookie, since the whole point is to show the set-password prompt\n * right away, not require also having ?edit=true or an unsuppressed cookie.\n */\nexport function resolveEditMode(\n  viewer: GRViewer | null,\n  cookieStore: { get(name: string): { value: string } | undefined },\n): { isEditMode: boolean; needsPassword: boolean } {\n  const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;\n  const needsPassword = cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === \"true\";\n  const isEditMode =\n    needsPassword ||\n    (editCookie === \"false\" ? false : editCookie === \"true\" || viewer !== null);\n  return { isEditMode, needsPassword };\n}\n"],"mappings":"AAAA,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAqB3B,eAAsB,YACpB,SAC0B;AAC1B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAGA,eAAsB,UAA4B;AAChD,SAAQ,MAAM,YAAY,CAAC,OAAO,CAAC,MAAO;AAC5C;AAQA,eAAsB,WAA6B;AACjD,SAAQ,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC,MAAO;AACtD;AAgBA,eAAsB,UAA4B;AAChD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,gBAAgB,QAAQ,MAAM,QAAQ,CAAC,EAAE;AAClD;AAuBO,SAAS,gBACd,QACA,aACiD;AACjD,QAAM,aAAa,YAAY,IAAI,WAAW,SAAS,GAAG;AAC1D,QAAM,gBAAgB,YAAY,IAAI,WAAW,cAAc,GAAG,UAAU;AAC5E,QAAM,aACJ,kBACC,eAAe,UAAU,QAAQ,eAAe,UAAU,WAAW;AACxE,SAAO,EAAE,YAAY,cAAc;AACrC;","names":[]}

package/dist/server/actions.d.ts

@@ -1,18 +1,31 @@
-import { GRRole, GRAsset, GRMember, ActionState, GRViewer, OverrideRow } from '../core/types.js';
-import { GRUploadTarget } from '../core/adapter-types.js';
+import { GRRole, GRAsset, GRMember, OverrideValue, SetPasswordState, ActionState, OverrideRow } from '../core/types.js';
+import { GRUploadTarget, AuthRedirectParams } from '../core/adapter-types.js';
 import 'react';
 
 type Result = {
     success: boolean;
     error?: string;
 };
+declare function saveOverride(row: OverrideRow): Promise<Result>;
 /**
- * Every mutation re-resolves the viewer server-side. The client's copy of the
- * role decides what to *show*; it never decides what is *allowed*. A hidden
- * button is not authorization — this is the same lesson as the session cookie.
+ * Writes one field's value by id, with no <GRail> involved — the setter that
+ * pairs with getFieldValue(). It exists for fields with nothing on the page to
+ * click: an SEO title or meta description, an og:image, a product's stock
+ * note. Build a drawer or form of your own, and have it (or a Server Action of
+ * yours) call this.
+ *
+ * A bare string is shorthand for a text field. Pass an OverrideValue for the
+ * other types ({ type: "image", src, alt }, a link, a button).
+ *
+ * Does its own role check — an editor or admin — so it is safe to call
+ * directly from a Client Component, the same as saveOverride. If your own
+ * action does other work first, check isEditor() there too.
+ *
+ * Writes the same row a <GRail> with this id would, so the two stay
+ * interchangeable: a field first written here can later be given a visible
+ * <GRail>, and vice versa.
  */
-declare function requireRole(allowed: readonly GRRole[]): Promise<GRViewer | null>;
-declare function saveOverride(row: OverrideRow): Promise<Result>;
+declare function setFieldValue(id: string, value: string | OverrideValue): Promise<Result>;
 /**
  * Authorizes an upload and returns where the browser should send the bytes.
  * Only metadata comes through here — the file itself goes straight to storage.
@@ -37,5 +50,33 @@ declare function loginAction(_prev: ActionState, formData: FormData): Promise<Ac
 declare function logoutAction(): Promise<{
     success: boolean;
 }>;
+/**
+ * Completes a session that arrived via an invite, magic-link, or
+ * password-recovery redirect. Called by AuthRedirectSync (react/), the
+ * generic client component that notices this kind of link and hands off
+ * whatever it found in the URL — the actual token exchange is entirely the
+ * auth adapter's job (see GRAuthAdapter.completeAuthRedirect); core only
+ * orchestrates the result.
+ *
+ * A no-op {success:false}, not an error, when the adapter doesn't implement
+ * this — most page loads carry no redirect data at all, and an adapter with
+ * no such concept should not make every one of them fail.
+ */
+declare function completeAuthRedirectAction(params: AuthRedirectParams): Promise<{
+    success: boolean;
+    needsPassword?: boolean;
+    error?: string;
+}>;
+/**
+ * Sets the current session's password — the prompt completeAuthRedirectAction
+ * triggers via needsPassword. Requires only a valid session, not a role: an
+ * invited person's role is claimed as a side effect of getCachedViewer()
+ * resolving them, which already happens independently of this.
+ */
+declare function setPasswordAction(_prev: SetPasswordState, formData: FormData): Promise<SetPasswordState>;
+/** Dismisses the set-password prompt without setting one — see Admin.tsx. */
+declare function skipSetPasswordAction(): Promise<{
+    success: boolean;
+}>;
 
-export { createAssetUpload, inviteMember, listAssets, listTeam, loginAction, logoutAction, removeMember, requireRole, saveOverride, updateMemberRole };
+export { completeAuthRedirectAction, createAssetUpload, inviteMember, listAssets, listTeam, loginAction, logoutAction, removeMember, saveOverride, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole };

package/dist/server/actions.js

@@ -1,6 +1,6 @@
 "use server";
 import { revalidatePath } from "next/cache";
-import { headers } from "next/headers";
+import { cookies, headers } from "next/headers";
 import {
   getAuth,
   getDB,
@@ -10,21 +10,33 @@ import {
   resolveSiteId
 } from "../core/config";
 import { getCachedViewer } from "./session";
+import { requireRole } from "./access";
 import { rethrowIfBailout } from "../core/bailout";
+import { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from "../core/defs";
 const DENIED = { success: false, error: "Unauthorized." };
-async function requireRole(allowed) {
-  const viewer = await getCachedViewer();
-  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;
-  return viewer;
-}
 async function saveOverride(row) {
   const viewer = await requireRole(["admin", "editor"]);
   if (!viewer) return DENIED;
+  return writeOverride(row.pathKey, row.value);
+}
+const OVERRIDE_TYPES = ["text", "link", "image", "button"];
+async function setFieldValue(id, value) {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return DENIED;
+  const pathKey = id.trim();
+  if (!pathKey) return { success: false, error: "A field id is required." };
+  const normalized = typeof value === "string" ? { type: "text", text: value } : value;
+  if (!OVERRIDE_TYPES.includes(normalized.type)) {
+    return { success: false, error: `Unknown field type "${normalized.type}".` };
+  }
+  return writeOverride(pathKey, normalized);
+}
+async function writeOverride(pathKey, value) {
   const rowToSend = {
-    pathKey: row.pathKey,
+    pathKey,
     siteId: await resolveSiteId(),
-    type: row.value.type,
-    value: row.value
+    type: value.type,
+    value
   };
   try {
     const db = getDB();
@@ -196,10 +208,51 @@ async function loginAction(_prev, formData) {
 async function logoutAction() {
   const auth = getAuth();
   await auth.logout();
+  const cookieStore = await cookies();
+  cookieStore.delete(GR_COOKIES.EDIT_MODE);
+  revalidatePath("/", "layout");
+  return { success: true };
+}
+async function completeAuthRedirectAction(params) {
+  const auth = getAuth();
+  if (!auth.completeAuthRedirect) return { success: false };
+  const res = await auth.completeAuthRedirect(params);
+  if (res.success) {
+    if (res.needsPassword) {
+      const cookieStore = await cookies();
+      cookieStore.set(GR_COOKIES.NEEDS_PASSWORD, "true", {
+        path: "/",
+        maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS
+      });
+    }
+    revalidatePath("/", "layout");
+  }
+  return res;
+}
+async function setPasswordAction(_prev, formData) {
+  const viewer = await getCachedViewer();
+  if (!viewer) return { success: false, error: "Not signed in." };
+  const auth = getAuth();
+  if (!auth.setPassword) {
+    return { success: false, error: "This site's auth provider does not support setting a password." };
+  }
+  const password = String(formData.get("password") ?? "");
+  const res = await auth.setPassword(password);
+  if (res.success) {
+    const cookieStore = await cookies();
+    cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);
+    revalidatePath("/", "layout");
+  }
+  return res;
+}
+async function skipSetPasswordAction() {
+  const cookieStore = await cookies();
+  cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);
   revalidatePath("/", "layout");
   return { success: true };
 }
 export {
+  completeAuthRedirectAction,
   createAssetUpload,
   inviteMember,
   listAssets,
@@ -207,8 +260,10 @@ export {
   loginAction,
   logoutAction,
   removeMember,
-  requireRole,
   saveOverride,
+  setFieldValue,
+  setPasswordAction,
+  skipSetPasswordAction,
   updateMemberRole
 };
 //# sourceMappingURL=actions.js.map

package/dist/server/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/actions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { headers } from \"next/headers\";\nimport {\n  getAuth,\n  getDB,\n  getInviteHandler,\n  getMembers,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type {\n  ActionState,\n  GRAsset,\n  GRMember,\n  GRRole,\n  GRViewer,\n  OverrideRow,\n} from \"../core/types\";\nimport type { GRStorageRow, GRUploadTarget } from \"../core/adapter-types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\n/**\n * Every mutation re-resolves the viewer server-side. The client's copy of the\n * role decides what to *show*; it never decides what is *allowed*. A hidden\n * button is not authorization — this is the same lesson as the session cookie.\n */\nexport async function requireRole(\n  allowed: readonly GRRole[],\n): Promise<GRViewer | null> {\n  const viewer = await getCachedViewer();\n  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;\n  return viewer;\n}\n\nexport async function saveOverride(row: OverrideRow): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  const rowToSend: GRStorageRow = {\n    pathKey: row.pathKey,\n    siteId: await resolveSiteId(),\n    type: row.value.type,\n    value: row.value,\n  };\n\n  try {\n    const db = getDB();\n    const res = await db.setOverride(rowToSend);\n    if (!res.success) return res;\n\n    // TODO: too broad — purges every cached route on any single-field save.\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: save failed\", e);\n    return { success: false, error: \"Database write failed.\" };\n  }\n}\n\n/* --------------------------------------------------------------- media --- */\n\n// SVG is excluded on purpose: it can carry script, and next/image refuses it\n// by default anyway.\nconst IMAGE_TYPES = [\"image/png\", \"image/jpeg\", \"image/webp\", \"image/gif\", \"image/avif\"];\nconst MAX_UPLOAD_BYTES = 10 * 1024 * 1024;\n\n/**\n * Authorizes an upload and returns where the browser should send the bytes.\n * Only metadata comes through here — the file itself goes straight to storage.\n */\nexport async function createAssetUpload(file: {\n  name: string;\n  contentType: string;\n  size: number;\n}): Promise<\n  { success: true; target: GRUploadTarget } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  const storage = getStorage();\n  if (!storage) {\n    return { success: false, error: \"No storage adapter is configured.\" };\n  }\n  if (!IMAGE_TYPES.includes(file.contentType)) {\n    return { success: false, error: \"Upload a PNG, JPEG, WebP, GIF, or AVIF image.\" };\n  }\n  if (!(file.size > 0) || file.size > MAX_UPLOAD_BYTES) {\n    return { success: false, error: \"Images must be under 10 MB.\" };\n  }\n\n  try {\n    const target = await storage.createUpload(await resolveSiteId(), file);\n    return { success: true, target };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: createUpload failed\", e);\n    // Failures here are almost always setup (missing SQL, bucket, or policy),\n    // so show the cause while developing. Production keeps it generic rather\n    // than exposing backend detail to editors.\n    const detail =\n      process.env.NODE_ENV !== \"production\" && e instanceof Error\n        ? ` ${e.message}`\n        : \"\";\n    return { success: false, error: `Could not start the upload.${detail}` };\n  }\n}\n\nexport async function listAssets(): Promise<GRAsset[]> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  const storage = getStorage();\n  if (!viewer || !storage) return [];\n  return storage.listAssets(await resolveSiteId());\n}\n\n/* ---------------------------------------------------------------- team --- */\n\nexport async function listTeam(): Promise<GRMember[]> {\n  // Any member may see who else is on the site; only admins may change it.\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return [];\n\n  const members = getMembers();\n  return members.listMembers(await resolveSiteId());\n}\n\nexport async function inviteMember(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const normalized = email.toLowerCase().trim();\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(normalized)) {\n    return { success: false, error: \"Enter a valid email address.\" };\n  }\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const existing = await members.getMember(siteId, { email: normalized });\n  if (existing?.status === \"active\") {\n    return { success: false, error: \"That address is already on the team.\" };\n  }\n\n  // A pending invite is re-sent rather than rejected: provider email is\n  // rate-limited and unreliable enough that resending has to be possible.\n  if (!existing) {\n    const res = await members.upsertMember(siteId, {\n      email: normalized,\n      role,\n      userId: null,\n      status: \"pending\",\n    });\n    if (!res.success) return res;\n  }\n\n  const auth = getAuth();\n  if (auth.inviteUser) {\n    // The membership is already written; a failed send must not undo it.\n    const sent = await auth.inviteUser(normalized, {\n      redirectTo: `${await requestOrigin()}/?edit=true`,\n    });\n    revalidatePath(\"/\", \"layout\");\n    return sent.success\n      ? { success: true }\n      : {\n          success: false,\n          error: `Invite saved, but the email failed: ${sent.error}`,\n        };\n  }\n\n  // No provider-side delivery, so hand off to the app.\n  try {\n    await getInviteHandler()?.({\n      email: normalized,\n      role: existing?.role ?? role,\n      siteId,\n      invitedBy: viewer.email ?? viewer.userId,\n    });\n  } catch (e) {\n    console.error(\"Guardrail: onInvite handler threw\", e);\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\nexport async function updateMemberRole(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const target = await members.getMember(siteId, {\n    email: email.toLowerCase().trim(),\n  });\n  if (!target) return { success: false, error: \"No such member.\" };\n\n  if (target.role === \"admin\" && role !== \"admin\") {\n    const guard = await wouldStrandSite(siteId, target.email);\n    if (guard) return guard;\n  }\n\n  const res = await members.upsertMember(siteId, {\n    email: target.email,\n    role,\n    userId: target.userId,\n    status: target.status,\n  });\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nexport async function removeMember(email: string): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n  const normalized = email.toLowerCase().trim();\n\n  const guard = await wouldStrandSite(siteId, normalized);\n  if (guard) return guard;\n\n  const res = await members.removeMember(siteId, normalized);\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nasync function requestOrigin(): Promise<string> {\n  const h = await headers();\n  const origin = h.get(\"origin\");\n  if (origin) return origin;\n  const host = h.get(\"x-forwarded-host\") ?? h.get(\"host\") ?? \"localhost\";\n  const proto = h.get(\"x-forwarded-proto\") ?? (host.startsWith(\"localhost\") ? \"http\" : \"https\");\n  return `${proto}://${host}`;\n}\n\n/**\n * Refuses changes that would leave a site with no admin, which would lock\n * everyone out of team management with no in-app way to recover.\n */\nasync function wouldStrandSite(\n  siteId: string,\n  email: string,\n): Promise<Result | null> {\n  const members = getMembers();\n  const all = await members.listMembers(siteId);\n  const admins = all.filter((m) => m.role === \"admin\");\n\n  if (admins.length <= 1 && admins.some((m) => m.email === email)) {\n    return {\n      success: false,\n      error: \"A site must keep at least one admin.\",\n    };\n  }\n  return null;\n}\n\n/* ---------------------------------------------------------------- auth --- */\n\nexport async function loginAction(\n  _prev: ActionState,\n  formData: FormData,\n): Promise<ActionState> {\n  const email = String(formData.get(\"email\") ?? \"\");\n  const password = String(formData.get(\"password\") ?? \"\");\n\n  const auth = getAuth();\n  if (!auth.authenticate) {\n    return {\n      success: false,\n      error: \"This site's auth provider does not accept passwords.\",\n      email,\n    };\n  }\n\n  const result = await auth.authenticate(email, password);\n  if (!result.success) {\n    return { success: false, error: result.error, email };\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true, email };\n}\n\nexport async function logoutAction(): Promise<{ success: boolean }> {\n  const auth = getAuth();\n  await auth.logout();\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AAajC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAOhE,eAAsB,YACpB,SAC0B;AAC1B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,eAAsB,aAAa,KAAmC;AACpE,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,YAA0B;AAAA,IAC9B,SAAS,IAAI;AAAA,IACb,QAAQ,MAAM,cAAc;AAAA,IAC5B,MAAM,IAAI,MAAM;AAAA,IAChB,OAAO,IAAI;AAAA,EACb;AAEA,MAAI;AACF,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,MAAM,GAAG,YAAY,SAAS;AAC1C,QAAI,CAAC,IAAI,QAAS,QAAO;AAGzB,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0BAA0B,CAAC;AACzC,WAAO,EAAE,SAAS,OAAO,OAAO,yBAAyB;AAAA,EAC3D;AACF;AAMA,MAAM,cAAc,CAAC,aAAa,cAAc,cAAc,aAAa,YAAY;AACvF,MAAM,mBAAmB,KAAK,OAAO;AAMrC,eAAsB,kBAAkB,MAMtC;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,oCAAoC;AAAA,EACtE;AACA,MAAI,CAAC,YAAY,SAAS,KAAK,WAAW,GAAG;AAC3C,WAAO,EAAE,SAAS,OAAO,OAAO,gDAAgD;AAAA,EAClF;AACA,MAAI,EAAE,KAAK,OAAO,MAAM,KAAK,OAAO,kBAAkB;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B;AAAA,EAChE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,cAAc,GAAG,IAAI;AACrE,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,kCAAkC,CAAC;AAIjD,UAAM,SACJ,QAAQ,IAAI,aAAa,gBAAgB,aAAa,QAClD,IAAI,EAAE,OAAO,KACb;AACN,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B,MAAM,GAAG;AAAA,EACzE;AACF;AAEA,eAAsB,aAAiC;AACrD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO,CAAC;AACjC,SAAO,QAAQ,WAAW,MAAM,cAAc,CAAC;AACjD;AAIA,eAAsB,WAAgC;AAEpD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,UAAU,WAAW;AAC3B,SAAO,QAAQ,YAAY,MAAM,cAAc,CAAC;AAClD;AAEA,eAAsB,aACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAC5C,MAAI,CAAC,6BAA6B,KAAK,UAAU,GAAG;AAClD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AAEA,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,EAAE,OAAO,WAAW,CAAC;AACtE,MAAI,UAAU,WAAW,UAAU;AACjC,WAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,EACzE;AAIA,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,MAC7C,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,QAAS,QAAO;AAAA,EAC3B;AAEA,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,YAAY;AAEnB,UAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAAA,MAC7C,YAAY,GAAG,MAAM,cAAc,CAAC;AAAA,IACtC,CAAC;AACD,mBAAe,KAAK,QAAQ;AAC5B,WAAO,KAAK,UACR,EAAE,SAAS,KAAK,IAChB;AAAA,MACE,SAAS;AAAA,MACT,OAAO,uCAAuC,KAAK,KAAK;AAAA,IAC1D;AAAA,EACN;AAGA,MAAI;AACF,UAAM,iBAAiB,IAAI;AAAA,MACzB,OAAO;AAAA,MACP,MAAM,UAAU,QAAQ;AAAA,MACxB;AAAA,MACA,WAAW,OAAO,SAAS,OAAO;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,GAAG;AACV,YAAQ,MAAM,qCAAqC,CAAC;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAsB,iBACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ;AAAA,IAC7C,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAE/D,MAAI,OAAO,SAAS,WAAW,SAAS,SAAS;AAC/C,UAAM,QAAQ,MAAM,gBAAgB,QAAQ,OAAO,KAAK;AACxD,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,IAC7C,OAAO,OAAO;AAAA,IACd;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAsB,aAAa,OAAgC;AACjE,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAE5C,QAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,MAAI,MAAO,QAAO;AAElB,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ,UAAU;AACzD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAe,gBAAiC;AAC9C,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,QAAQ;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,OAAO,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,MAAM,KAAK;AAC3D,QAAM,QAAQ,EAAE,IAAI,mBAAmB,MAAM,KAAK,WAAW,WAAW,IAAI,SAAS;AACrF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAMA,eAAe,gBACb,QACA,OACwB;AACxB,QAAM,UAAU,WAAW;AAC3B,QAAM,MAAM,MAAM,QAAQ,YAAY,MAAM;AAC5C,QAAM,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO;AAEnD,MAAI,OAAO,UAAU,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIA,eAAsB,YACpB,OACA,UACsB;AACtB,QAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAChD,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AAEtD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,cAAc;AACtB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,KAAK,aAAa,OAAO,QAAQ;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,SAAS,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,MAAM,MAAM;AAChC;AAEA,eAAsB,eAA8C;AAClE,QAAM,OAAO,QAAQ;AACrB,QAAM,KAAK,OAAO;AAClB,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;","names":[]}
+{"version":3,"sources":["../../src/server/actions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { cookies, headers } from \"next/headers\";\nimport {\n  getAuth,\n  getDB,\n  getInviteHandler,\n  getMembers,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { requireRole } from \"./access\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from \"../core/defs\";\nimport type {\n  ActionState,\n  GRAsset,\n  GRMember,\n  GRRole,\n  OverrideRow,\n  OverrideType,\n  OverrideValue,\n  SetPasswordState,\n} from \"../core/types\";\nimport type {\n  AuthRedirectParams,\n  GRStorageRow,\n  GRUploadTarget,\n} from \"../core/adapter-types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\n// Every mutation below re-resolves the viewer server-side through\n// requireRole() (see access.ts) — the client's copy of the role decides what\n// to *show*, never what is *allowed*.\n\nexport async function saveOverride(row: OverrideRow): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n  return writeOverride(row.pathKey, row.value);\n}\n\nconst OVERRIDE_TYPES: readonly OverrideType[] = [\"text\", \"link\", \"image\", \"button\"];\n\n/**\n * Writes one field's value by id, with no <GRail> involved — the setter that\n * pairs with getFieldValue(). It exists for fields with nothing on the page to\n * click: an SEO title or meta description, an og:image, a product's stock\n * note. Build a drawer or form of your own, and have it (or a Server Action of\n * yours) call this.\n *\n * A bare string is shorthand for a text field. Pass an OverrideValue for the\n * other types ({ type: \"image\", src, alt }, a link, a button).\n *\n * Does its own role check — an editor or admin — so it is safe to call\n * directly from a Client Component, the same as saveOverride. If your own\n * action does other work first, check isEditor() there too.\n *\n * Writes the same row a <GRail> with this id would, so the two stay\n * interchangeable: a field first written here can later be given a visible\n * <GRail>, and vice versa.\n */\nexport async function setFieldValue(\n  id: string,\n  value: string | OverrideValue,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  const pathKey = id.trim();\n  if (!pathKey) return { success: false, error: \"A field id is required.\" };\n\n  const normalized: OverrideValue =\n    typeof value === \"string\" ? { type: \"text\", text: value } : value;\n  if (!OVERRIDE_TYPES.includes(normalized.type)) {\n    return { success: false, error: `Unknown field type \"${normalized.type}\".` };\n  }\n\n  return writeOverride(pathKey, normalized);\n}\n\n/** The write shared by saveOverride and setFieldValue; the caller has already authorized. */\nasync function writeOverride(\n  pathKey: string,\n  value: OverrideValue,\n): Promise<Result> {\n  const rowToSend: GRStorageRow = {\n    pathKey,\n    siteId: await resolveSiteId(),\n    type: value.type,\n    value,\n  };\n\n  try {\n    const db = getDB();\n    const res = await db.setOverride(rowToSend);\n    if (!res.success) return res;\n\n    // TODO: too broad — purges every cached route on any single-field save.\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: save failed\", e);\n    return { success: false, error: \"Database write failed.\" };\n  }\n}\n\n/* --------------------------------------------------------------- media --- */\n\n// SVG is excluded on purpose: it can carry script, and next/image refuses it\n// by default anyway.\nconst IMAGE_TYPES = [\"image/png\", \"image/jpeg\", \"image/webp\", \"image/gif\", \"image/avif\"];\nconst MAX_UPLOAD_BYTES = 10 * 1024 * 1024;\n\n/**\n * Authorizes an upload and returns where the browser should send the bytes.\n * Only metadata comes through here — the file itself goes straight to storage.\n */\nexport async function createAssetUpload(file: {\n  name: string;\n  contentType: string;\n  size: number;\n}): Promise<\n  { success: true; target: GRUploadTarget } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  const storage = getStorage();\n  if (!storage) {\n    return { success: false, error: \"No storage adapter is configured.\" };\n  }\n  if (!IMAGE_TYPES.includes(file.contentType)) {\n    return { success: false, error: \"Upload a PNG, JPEG, WebP, GIF, or AVIF image.\" };\n  }\n  if (!(file.size > 0) || file.size > MAX_UPLOAD_BYTES) {\n    return { success: false, error: \"Images must be under 10 MB.\" };\n  }\n\n  try {\n    const target = await storage.createUpload(await resolveSiteId(), file);\n    return { success: true, target };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: createUpload failed\", e);\n    // Failures here are almost always setup (missing SQL, bucket, or policy),\n    // so show the cause while developing. Production keeps it generic rather\n    // than exposing backend detail to editors.\n    const detail =\n      process.env.NODE_ENV !== \"production\" && e instanceof Error\n        ? ` ${e.message}`\n        : \"\";\n    return { success: false, error: `Could not start the upload.${detail}` };\n  }\n}\n\nexport async function listAssets(): Promise<GRAsset[]> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  const storage = getStorage();\n  if (!viewer || !storage) return [];\n  return storage.listAssets(await resolveSiteId());\n}\n\n/* ---------------------------------------------------------------- team --- */\n\nexport async function listTeam(): Promise<GRMember[]> {\n  // Any member may see who else is on the site; only admins may change it.\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return [];\n\n  const members = getMembers();\n  return members.listMembers(await resolveSiteId());\n}\n\nexport async function inviteMember(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const normalized = email.toLowerCase().trim();\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(normalized)) {\n    return { success: false, error: \"Enter a valid email address.\" };\n  }\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const existing = await members.getMember(siteId, { email: normalized });\n  if (existing?.status === \"active\") {\n    return { success: false, error: \"That address is already on the team.\" };\n  }\n\n  // A pending invite is re-sent rather than rejected: provider email is\n  // rate-limited and unreliable enough that resending has to be possible.\n  if (!existing) {\n    const res = await members.upsertMember(siteId, {\n      email: normalized,\n      role,\n      userId: null,\n      status: \"pending\",\n    });\n    if (!res.success) return res;\n  }\n\n  const auth = getAuth();\n  if (auth.inviteUser) {\n    // The membership is already written; a failed send must not undo it.\n    const sent = await auth.inviteUser(normalized, {\n      redirectTo: `${await requestOrigin()}/?edit=true`,\n    });\n    revalidatePath(\"/\", \"layout\");\n    return sent.success\n      ? { success: true }\n      : {\n          success: false,\n          error: `Invite saved, but the email failed: ${sent.error}`,\n        };\n  }\n\n  // No provider-side delivery, so hand off to the app.\n  try {\n    await getInviteHandler()?.({\n      email: normalized,\n      role: existing?.role ?? role,\n      siteId,\n      invitedBy: viewer.email ?? viewer.userId,\n    });\n  } catch (e) {\n    console.error(\"Guardrail: onInvite handler threw\", e);\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\nexport async function updateMemberRole(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const target = await members.getMember(siteId, {\n    email: email.toLowerCase().trim(),\n  });\n  if (!target) return { success: false, error: \"No such member.\" };\n\n  if (target.role === \"admin\" && role !== \"admin\") {\n    const guard = await wouldStrandSite(siteId, target.email);\n    if (guard) return guard;\n  }\n\n  const res = await members.upsertMember(siteId, {\n    email: target.email,\n    role,\n    userId: target.userId,\n    status: target.status,\n  });\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nexport async function removeMember(email: string): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n  const normalized = email.toLowerCase().trim();\n\n  const guard = await wouldStrandSite(siteId, normalized);\n  if (guard) return guard;\n\n  const res = await members.removeMember(siteId, normalized);\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nasync function requestOrigin(): Promise<string> {\n  const h = await headers();\n  const origin = h.get(\"origin\");\n  if (origin) return origin;\n  const host = h.get(\"x-forwarded-host\") ?? h.get(\"host\") ?? \"localhost\";\n  const proto = h.get(\"x-forwarded-proto\") ?? (host.startsWith(\"localhost\") ? \"http\" : \"https\");\n  return `${proto}://${host}`;\n}\n\n/**\n * Refuses changes that would leave a site with no admin, which would lock\n * everyone out of team management with no in-app way to recover.\n */\nasync function wouldStrandSite(\n  siteId: string,\n  email: string,\n): Promise<Result | null> {\n  const members = getMembers();\n  const all = await members.listMembers(siteId);\n  const admins = all.filter((m) => m.role === \"admin\");\n\n  if (admins.length <= 1 && admins.some((m) => m.email === email)) {\n    return {\n      success: false,\n      error: \"A site must keep at least one admin.\",\n    };\n  }\n  return null;\n}\n\n/* ---------------------------------------------------------------- auth --- */\n\nexport async function loginAction(\n  _prev: ActionState,\n  formData: FormData,\n): Promise<ActionState> {\n  const email = String(formData.get(\"email\") ?? \"\");\n  const password = String(formData.get(\"password\") ?? \"\");\n\n  const auth = getAuth();\n  if (!auth.authenticate) {\n    return {\n      success: false,\n      error: \"This site's auth provider does not accept passwords.\",\n      email,\n    };\n  }\n\n  const result = await auth.authenticate(email, password);\n  if (!result.success) {\n    return { success: false, error: result.error, email };\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true, email };\n}\n\nexport async function logoutAction(): Promise<{ success: boolean }> {\n  const auth = getAuth();\n  await auth.logout();\n  // Cleared here, not by the client afterward: a Server Action's own\n  // revalidatePath() below triggers Next's router to refresh the current\n  // route automatically, which can race a client-side navigation attempted\n  // right after this resolves — confirmed live, where that automatic\n  // refresh (for the pre-logout URL, ?edit=true) won the race and silently\n  // undid a client-side `window.location.href` to the plain path. Deleting\n  // the cookie here instead makes it part of the one server round-trip that\n  // revalidatePath already accounts for, with nothing left to race.\n  const cookieStore = await cookies();\n  cookieStore.delete(GR_COOKIES.EDIT_MODE);\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\n/* ---------------------------------------------------------- redirects --- */\n\n/**\n * Completes a session that arrived via an invite, magic-link, or\n * password-recovery redirect. Called by AuthRedirectSync (react/), the\n * generic client component that notices this kind of link and hands off\n * whatever it found in the URL — the actual token exchange is entirely the\n * auth adapter's job (see GRAuthAdapter.completeAuthRedirect); core only\n * orchestrates the result.\n *\n * A no-op {success:false}, not an error, when the adapter doesn't implement\n * this — most page loads carry no redirect data at all, and an adapter with\n * no such concept should not make every one of them fail.\n */\nexport async function completeAuthRedirectAction(\n  params: AuthRedirectParams,\n): Promise<{ success: boolean; needsPassword?: boolean; error?: string }> {\n  const auth = getAuth();\n  if (!auth.completeAuthRedirect) return { success: false };\n\n  const res = await auth.completeAuthRedirect(params);\n  if (res.success) {\n    if (res.needsPassword) {\n      const cookieStore = await cookies();\n      cookieStore.set(GR_COOKIES.NEEDS_PASSWORD, \"true\", {\n        path: \"/\",\n        maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS,\n      });\n    }\n    revalidatePath(\"/\", \"layout\");\n  }\n  return res;\n}\n\n/**\n * Sets the current session's password — the prompt completeAuthRedirectAction\n * triggers via needsPassword. Requires only a valid session, not a role: an\n * invited person's role is claimed as a side effect of getCachedViewer()\n * resolving them, which already happens independently of this.\n */\nexport async function setPasswordAction(\n  _prev: SetPasswordState,\n  formData: FormData,\n): Promise<SetPasswordState> {\n  const viewer = await getCachedViewer();\n  if (!viewer) return { success: false, error: \"Not signed in.\" };\n\n  const auth = getAuth();\n  if (!auth.setPassword) {\n    return { success: false, error: \"This site's auth provider does not support setting a password.\" };\n  }\n\n  const password = String(formData.get(\"password\") ?? \"\");\n  const res = await auth.setPassword(password);\n  if (res.success) {\n    const cookieStore = await cookies();\n    cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);\n    revalidatePath(\"/\", \"layout\");\n  }\n  return res;\n}\n\n/** Dismisses the set-password prompt without setting one — see Admin.tsx. */\nexport async function skipSetPasswordAction(): Promise<{ success: boolean }> {\n  const cookieStore = await cookies();\n  cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,SAAS,eAAe;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AACjC,SAAS,YAAY,qCAAqC;AAmB1D,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAMhE,eAAsB,aAAa,KAAmC;AACpE,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,cAAc,IAAI,SAAS,IAAI,KAAK;AAC7C;AAEA,MAAM,iBAA0C,CAAC,QAAQ,QAAQ,SAAS,QAAQ;AAoBlF,eAAsB,cACpB,IACA,OACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,UAAU,GAAG,KAAK;AACxB,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAExE,QAAM,aACJ,OAAO,UAAU,WAAW,EAAE,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9D,MAAI,CAAC,eAAe,SAAS,WAAW,IAAI,GAAG;AAC7C,WAAO,EAAE,SAAS,OAAO,OAAO,uBAAuB,WAAW,IAAI,KAAK;AAAA,EAC7E;AAEA,SAAO,cAAc,SAAS,UAAU;AAC1C;AAGA,eAAe,cACb,SACA,OACiB;AACjB,QAAM,YAA0B;AAAA,IAC9B;AAAA,IACA,QAAQ,MAAM,cAAc;AAAA,IAC5B,MAAM,MAAM;AAAA,IACZ;AAAA,EACF;AAEA,MAAI;AACF,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,MAAM,GAAG,YAAY,SAAS;AAC1C,QAAI,CAAC,IAAI,QAAS,QAAO;AAGzB,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0BAA0B,CAAC;AACzC,WAAO,EAAE,SAAS,OAAO,OAAO,yBAAyB;AAAA,EAC3D;AACF;AAMA,MAAM,cAAc,CAAC,aAAa,cAAc,cAAc,aAAa,YAAY;AACvF,MAAM,mBAAmB,KAAK,OAAO;AAMrC,eAAsB,kBAAkB,MAMtC;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,oCAAoC;AAAA,EACtE;AACA,MAAI,CAAC,YAAY,SAAS,KAAK,WAAW,GAAG;AAC3C,WAAO,EAAE,SAAS,OAAO,OAAO,gDAAgD;AAAA,EAClF;AACA,MAAI,EAAE,KAAK,OAAO,MAAM,KAAK,OAAO,kBAAkB;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B;AAAA,EAChE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,cAAc,GAAG,IAAI;AACrE,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,kCAAkC,CAAC;AAIjD,UAAM,SACJ,QAAQ,IAAI,aAAa,gBAAgB,aAAa,QAClD,IAAI,EAAE,OAAO,KACb;AACN,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B,MAAM,GAAG;AAAA,EACzE;AACF;AAEA,eAAsB,aAAiC;AACrD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO,CAAC;AACjC,SAAO,QAAQ,WAAW,MAAM,cAAc,CAAC;AACjD;AAIA,eAAsB,WAAgC;AAEpD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,UAAU,WAAW;AAC3B,SAAO,QAAQ,YAAY,MAAM,cAAc,CAAC;AAClD;AAEA,eAAsB,aACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAC5C,MAAI,CAAC,6BAA6B,KAAK,UAAU,GAAG;AAClD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AAEA,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,EAAE,OAAO,WAAW,CAAC;AACtE,MAAI,UAAU,WAAW,UAAU;AACjC,WAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,EACzE;AAIA,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,MAC7C,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,QAAS,QAAO;AAAA,EAC3B;AAEA,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,YAAY;AAEnB,UAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAAA,MAC7C,YAAY,GAAG,MAAM,cAAc,CAAC;AAAA,IACtC,CAAC;AACD,mBAAe,KAAK,QAAQ;AAC5B,WAAO,KAAK,UACR,EAAE,SAAS,KAAK,IAChB;AAAA,MACE,SAAS;AAAA,MACT,OAAO,uCAAuC,KAAK,KAAK;AAAA,IAC1D;AAAA,EACN;AAGA,MAAI;AACF,UAAM,iBAAiB,IAAI;AAAA,MACzB,OAAO;AAAA,MACP,MAAM,UAAU,QAAQ;AAAA,MACxB;AAAA,MACA,WAAW,OAAO,SAAS,OAAO;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,GAAG;AACV,YAAQ,MAAM,qCAAqC,CAAC;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAsB,iBACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ;AAAA,IAC7C,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAE/D,MAAI,OAAO,SAAS,WAAW,SAAS,SAAS;AAC/C,UAAM,QAAQ,MAAM,gBAAgB,QAAQ,OAAO,KAAK;AACxD,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,IAC7C,OAAO,OAAO;AAAA,IACd;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAsB,aAAa,OAAgC;AACjE,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAE5C,QAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,MAAI,MAAO,QAAO;AAElB,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ,UAAU;AACzD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAe,gBAAiC;AAC9C,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,QAAQ;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,OAAO,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,MAAM,KAAK;AAC3D,QAAM,QAAQ,EAAE,IAAI,mBAAmB,MAAM,KAAK,WAAW,WAAW,IAAI,SAAS;AACrF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAMA,eAAe,gBACb,QACA,OACwB;AACxB,QAAM,UAAU,WAAW;AAC3B,QAAM,MAAM,MAAM,QAAQ,YAAY,MAAM;AAC5C,QAAM,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO;AAEnD,MAAI,OAAO,UAAU,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIA,eAAsB,YACpB,OACA,UACsB;AACtB,QAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAChD,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AAEtD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,cAAc;AACtB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,KAAK,aAAa,OAAO,QAAQ;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,SAAS,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,MAAM,MAAM;AAChC;AAEA,eAAsB,eAA8C;AAClE,QAAM,OAAO,QAAQ;AACrB,QAAM,KAAK,OAAO;AASlB,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,WAAW,SAAS;AACvC,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAgBA,eAAsB,2BACpB,QACwE;AACxE,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,qBAAsB,QAAO,EAAE,SAAS,MAAM;AAExD,QAAM,MAAM,MAAM,KAAK,qBAAqB,MAAM;AAClD,MAAI,IAAI,SAAS;AACf,QAAI,IAAI,eAAe;AACrB,YAAM,cAAc,MAAM,QAAQ;AAClC,kBAAY,IAAI,WAAW,gBAAgB,QAAQ;AAAA,QACjD,MAAM;AAAA,QACN,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,mBAAe,KAAK,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAQA,eAAsB,kBACpB,OACA,UAC2B;AAC3B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAE9D,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,aAAa;AACrB,WAAO,EAAE,SAAS,OAAO,OAAO,iEAAiE;AAAA,EACnG;AAEA,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AACtD,QAAM,MAAM,MAAM,KAAK,YAAY,QAAQ;AAC3C,MAAI,IAAI,SAAS;AACf,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,OAAO,WAAW,cAAc;AAC5C,mBAAe,KAAK,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAGA,eAAsB,wBAAuD;AAC3E,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,WAAW,cAAc;AAC5C,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;","names":[]}

package/dist/server/fieldData.d.ts

@@ -10,8 +10,10 @@ import 'react';
  * config.
  *
  * Read-only: this does not make a field editable on its own. Give the same
- * id a normal <GRail> somewhere for an editor to change it; this just reads
- * whatever that field currently holds.
+ * id a normal <GRail> somewhere for an editor to change it, or — for a field
+ * with nothing on the page to click, like a meta description — build your own
+ * editing UI around setFieldValue(). This just reads whatever the field
+ * currently holds.
  *
  * Shares <GRail>'s request-scoped batching loader, so calling this alongside
  * other fields — including several of these via Promise.all — still resolves

package/dist/server/fieldData.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/fieldData.ts"],"sourcesContent":["import { loadOverride } from \"./loader\";\nimport type { OverrideValue } from \"../core/types\";\n\n/**\n * Reads a field's current value with no rendering attached.\n *\n * <GRail> covers \"render this as an editable element.\" This covers \"give me\n * the data so I can build something GRail doesn't render itself\" — an embed\n * iframe's src, an og:image meta tag, structured data, a third-party widget's\n * config.\n *\n * Read-only: this does not make a field editable on its own. Give the same\n * id a normal <GRail> somewhere for an editor to change it; this just reads\n * whatever that field currently holds.\n *\n * Shares <GRail>'s request-scoped batching loader, so calling this alongside\n * other fields — including several of these via Promise.all — still resolves\n * in one query, not one per call.\n *\n * Returns null when nothing has been saved yet. There is no `children`\n * fallback to fall back to here, since nothing is rendered — supply your own\n * default in the calling code.\n */\nexport async function getFieldValue(id: string): Promise<OverrideValue | null> {\n  const row = await loadOverride(id);\n  return row?.value ?? null;\n}\n"],"mappings":"AAAA,SAAS,oBAAoB;AAuB7B,eAAsB,cAAc,IAA2C;AAC7E,QAAM,MAAM,MAAM,aAAa,EAAE;AACjC,SAAO,KAAK,SAAS;AACvB;","names":[]}
+{"version":3,"sources":["../../src/server/fieldData.ts"],"sourcesContent":["import { loadOverride } from \"./loader\";\nimport type { OverrideValue } from \"../core/types\";\n\n/**\n * Reads a field's current value with no rendering attached.\n *\n * <GRail> covers \"render this as an editable element.\" This covers \"give me\n * the data so I can build something GRail doesn't render itself\" — an embed\n * iframe's src, an og:image meta tag, structured data, a third-party widget's\n * config.\n *\n * Read-only: this does not make a field editable on its own. Give the same\n * id a normal <GRail> somewhere for an editor to change it, or — for a field\n * with nothing on the page to click, like a meta description — build your own\n * editing UI around setFieldValue(). This just reads whatever the field\n * currently holds.\n *\n * Shares <GRail>'s request-scoped batching loader, so calling this alongside\n * other fields — including several of these via Promise.all — still resolves\n * in one query, not one per call.\n *\n * Returns null when nothing has been saved yet. There is no `children`\n * fallback to fall back to here, since nothing is rendered — supply your own\n * default in the calling code.\n */\nexport async function getFieldValue(id: string): Promise<OverrideValue | null> {\n  const row = await loadOverride(id);\n  return row?.value ?? null;\n}\n"],"mappings":"AAAA,SAAS,oBAAoB;AAyB7B,eAAsB,cAAc,IAA2C;AAC7E,QAAM,MAAM,MAAM,aAAa,EAAE;AACjC,SAAO,KAAK,SAAS;AACvB;","names":[]}

package/dist/server/repeaterActions.js

@@ -1,7 +1,7 @@
 "use server";
 import { revalidatePath } from "next/cache";
 import { getDB, getRepeaters, resolveSiteId } from "../core/config";
-import { requireRole } from "./actions";
+import { requireRole } from "./access";
 import { rethrowIfBailout } from "../core/bailout";
 const DENIED = { success: false, error: "Unauthorized." };
 async function addRepeaterItem(repeaterId, options) {

package/dist/server/repeaterActions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/repeaterActions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { getDB, getRepeaters, resolveSiteId } from \"../core/config\";\nimport { requireRole } from \"./actions\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRRepeaterItem } from \"../core/types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\nexport async function addRepeaterItem(\n  repeaterId: string,\n  options?: { slug?: string },\n): Promise<\n  { success: true; item: GRRepeaterItem } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  if (options?.slug !== undefined) {\n    const slug = options.slug.trim();\n    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {\n      return {\n        success: false,\n        error: \"Use lowercase letters, numbers, and hyphens only.\",\n      };\n    }\n    options = { slug };\n  }\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.addItem(repeaterId, await resolveSiteId(), options);\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: addRepeaterItem failed\", e);\n    return { success: false, error: \"Could not add the item.\" };\n  }\n}\n\nexport async function removeRepeaterItem(\n  repeaterId: string,\n  itemId: string,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const siteId = await resolveSiteId();\n    const repeaters = getRepeaters();\n    const res = await repeaters.removeItem(repeaterId, siteId, itemId);\n    if (!res.success) return res;\n\n    // Best-effort: an adapter that can't do this cheaply just leaves the old\n    // field values behind, unreachable but harmless.\n    const db = getDB();\n    await db.deleteOverrides?.(`${repeaterId}.${itemId}.`, siteId);\n\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: removeRepeaterItem failed\", e);\n    return { success: false, error: \"Could not remove the item.\" };\n  }\n}\n\nexport async function reorderRepeaterItems(\n  repeaterId: string,\n  orderedItemIds: string[],\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.reorderItems(\n      repeaterId,\n      await resolveSiteId(),\n      orderedItemIds,\n    );\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: reorderRepeaterItems failed\", e);\n    return { success: false, error: \"Could not reorder the items.\" };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,OAAO,cAAc,qBAAqB;AACnD,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AAKjC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAEhE,eAAsB,gBACpB,YACA,SAGA;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AACA,cAAU,EAAE,KAAK;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,QAAQ,YAAY,MAAM,cAAc,GAAG,OAAO;AAC9E,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,qCAAqC,CAAC;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAAA,EAC5D;AACF;AAEA,eAAsB,mBACpB,YACA,QACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,SAAS,MAAM,cAAc;AACnC,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,WAAW,YAAY,QAAQ,MAAM;AACjE,QAAI,CAAC,IAAI,QAAS,QAAO;AAIzB,UAAM,KAAK,MAAM;AACjB,UAAM,GAAG,kBAAkB,GAAG,UAAU,IAAI,MAAM,KAAK,MAAM;AAE7D,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,wCAAwC,CAAC;AACvD,WAAO,EAAE,SAAS,OAAO,OAAO,6BAA6B;AAAA,EAC/D;AACF;AAEA,eAAsB,qBACpB,YACA,gBACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA,MAAM,cAAc;AAAA,MACpB;AAAA,IACF;AACA,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0CAA0C,CAAC;AACzD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AACF;","names":[]}
+{"version":3,"sources":["../../src/server/repeaterActions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { getDB, getRepeaters, resolveSiteId } from \"../core/config\";\nimport { requireRole } from \"./access\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRRepeaterItem } from \"../core/types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\nexport async function addRepeaterItem(\n  repeaterId: string,\n  options?: { slug?: string },\n): Promise<\n  { success: true; item: GRRepeaterItem } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  if (options?.slug !== undefined) {\n    const slug = options.slug.trim();\n    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {\n      return {\n        success: false,\n        error: \"Use lowercase letters, numbers, and hyphens only.\",\n      };\n    }\n    options = { slug };\n  }\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.addItem(repeaterId, await resolveSiteId(), options);\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: addRepeaterItem failed\", e);\n    return { success: false, error: \"Could not add the item.\" };\n  }\n}\n\nexport async function removeRepeaterItem(\n  repeaterId: string,\n  itemId: string,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const siteId = await resolveSiteId();\n    const repeaters = getRepeaters();\n    const res = await repeaters.removeItem(repeaterId, siteId, itemId);\n    if (!res.success) return res;\n\n    // Best-effort: an adapter that can't do this cheaply just leaves the old\n    // field values behind, unreachable but harmless.\n    const db = getDB();\n    await db.deleteOverrides?.(`${repeaterId}.${itemId}.`, siteId);\n\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: removeRepeaterItem failed\", e);\n    return { success: false, error: \"Could not remove the item.\" };\n  }\n}\n\nexport async function reorderRepeaterItems(\n  repeaterId: string,\n  orderedItemIds: string[],\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.reorderItems(\n      repeaterId,\n      await resolveSiteId(),\n      orderedItemIds,\n    );\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: reorderRepeaterItems failed\", e);\n    return { success: false, error: \"Could not reorder the items.\" };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,OAAO,cAAc,qBAAqB;AACnD,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AAKjC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAEhE,eAAsB,gBACpB,YACA,SAGA;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AACA,cAAU,EAAE,KAAK;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,QAAQ,YAAY,MAAM,cAAc,GAAG,OAAO;AAC9E,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,qCAAqC,CAAC;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAAA,EAC5D;AACF;AAEA,eAAsB,mBACpB,YACA,QACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,SAAS,MAAM,cAAc;AACnC,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,WAAW,YAAY,QAAQ,MAAM;AACjE,QAAI,CAAC,IAAI,QAAS,QAAO;AAIzB,UAAM,KAAK,MAAM;AACjB,UAAM,GAAG,kBAAkB,GAAG,UAAU,IAAI,MAAM,KAAK,MAAM;AAE7D,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,wCAAwC,CAAC;AACvD,WAAO,EAAE,SAAS,OAAO,OAAO,6BAA6B;AAAA,EAC/D;AACF;AAEA,eAAsB,qBACpB,YACA,gBACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA,MAAM,cAAc;AAAA,MACpB;AAAA,IACF;AACA,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0CAA0C,CAAC;AACzD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AACF;","names":[]}