@guard-rail/core 0.5.0 → 0.7.0

package/dist/server/actions.d.ts

@@ -1,4 +1,4 @@
-import { GRRole, GRAsset, GRMember, SetPasswordState, ActionState, GRViewer, OverrideRow } from '../core/types.js';
+import { GRRole, GRAsset, GRMember, OverrideValue, SetPasswordState, ActionState, OverrideRow } from '../core/types.js';
 import { GRUploadTarget, AuthRedirectParams } from '../core/adapter-types.js';
 import 'react';
 
@@ -6,13 +6,26 @@ type Result = {
     success: boolean;
     error?: string;
 };
+declare function saveOverride(row: OverrideRow): Promise<Result>;
 /**
- * Every mutation re-resolves the viewer server-side. The client's copy of the
- * role decides what to *show*; it never decides what is *allowed*. A hidden
- * button is not authorization — this is the same lesson as the session cookie.
+ * Writes one field's value by id, with no <GRail> involved — the setter that
+ * pairs with getFieldValue(). It exists for fields with nothing on the page to
+ * click: an SEO title or meta description, an og:image, a product's stock
+ * note. Build a drawer or form of your own, and have it (or a Server Action of
+ * yours) call this.
+ *
+ * A bare string is shorthand for a text field. Pass an OverrideValue for the
+ * other types ({ type: "image", src, alt }, a link, a button).
+ *
+ * Does its own role check — an editor or admin — so it is safe to call
+ * directly from a Client Component, the same as saveOverride. If your own
+ * action does other work first, check isEditor() there too.
+ *
+ * Writes the same row a <GRail> with this id would, so the two stay
+ * interchangeable: a field first written here can later be given a visible
+ * <GRail>, and vice versa.
  */
-declare function requireRole(allowed: readonly GRRole[]): Promise<GRViewer | null>;
-declare function saveOverride(row: OverrideRow): Promise<Result>;
+declare function setFieldValue(id: string, value: string | OverrideValue): Promise<Result>;
 /**
  * Authorizes an upload and returns where the browser should send the bytes.
  * Only metadata comes through here — the file itself goes straight to storage.
@@ -66,4 +79,4 @@ declare function skipSetPasswordAction(): Promise<{
     success: boolean;
 }>;
 
-export { completeAuthRedirectAction, createAssetUpload, inviteMember, listAssets, listTeam, loginAction, logoutAction, removeMember, requireRole, saveOverride, setPasswordAction, skipSetPasswordAction, updateMemberRole };
+export { completeAuthRedirectAction, createAssetUpload, inviteMember, listAssets, listTeam, loginAction, logoutAction, removeMember, saveOverride, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole };

package/dist/server/actions.js

@@ -10,22 +10,33 @@ import {
   resolveSiteId
 } from "../core/config";
 import { getCachedViewer } from "./session";
+import { requireRole } from "./access";
 import { rethrowIfBailout } from "../core/bailout";
 import { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from "../core/defs";
 const DENIED = { success: false, error: "Unauthorized." };
-async function requireRole(allowed) {
-  const viewer = await getCachedViewer();
-  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;
-  return viewer;
-}
 async function saveOverride(row) {
   const viewer = await requireRole(["admin", "editor"]);
   if (!viewer) return DENIED;
+  return writeOverride(row.pathKey, row.value);
+}
+const OVERRIDE_TYPES = ["text", "link", "image", "button"];
+async function setFieldValue(id, value) {
+  const viewer = await requireRole(["admin", "editor"]);
+  if (!viewer) return DENIED;
+  const pathKey = id.trim();
+  if (!pathKey) return { success: false, error: "A field id is required." };
+  const normalized = typeof value === "string" ? { type: "text", text: value } : value;
+  if (!OVERRIDE_TYPES.includes(normalized.type)) {
+    return { success: false, error: `Unknown field type "${normalized.type}".` };
+  }
+  return writeOverride(pathKey, normalized);
+}
+async function writeOverride(pathKey, value) {
   const rowToSend = {
-    pathKey: row.pathKey,
+    pathKey,
     siteId: await resolveSiteId(),
-    type: row.value.type,
-    value: row.value
+    type: value.type,
+    value
   };
   try {
     const db = getDB();
@@ -249,8 +260,8 @@ export {
   loginAction,
   logoutAction,
   removeMember,
-  requireRole,
   saveOverride,
+  setFieldValue,
   setPasswordAction,
   skipSetPasswordAction,
   updateMemberRole

package/dist/server/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/actions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { cookies, headers } from \"next/headers\";\nimport {\n  getAuth,\n  getDB,\n  getInviteHandler,\n  getMembers,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from \"../core/defs\";\nimport type {\n  ActionState,\n  GRAsset,\n  GRMember,\n  GRRole,\n  GRViewer,\n  OverrideRow,\n  SetPasswordState,\n} from \"../core/types\";\nimport type {\n  AuthRedirectParams,\n  GRStorageRow,\n  GRUploadTarget,\n} from \"../core/adapter-types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\n/**\n * Every mutation re-resolves the viewer server-side. The client's copy of the\n * role decides what to *show*; it never decides what is *allowed*. A hidden\n * button is not authorization — this is the same lesson as the session cookie.\n */\nexport async function requireRole(\n  allowed: readonly GRRole[],\n): Promise<GRViewer | null> {\n  const viewer = await getCachedViewer();\n  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;\n  return viewer;\n}\n\nexport async function saveOverride(row: OverrideRow): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  const rowToSend: GRStorageRow = {\n    pathKey: row.pathKey,\n    siteId: await resolveSiteId(),\n    type: row.value.type,\n    value: row.value,\n  };\n\n  try {\n    const db = getDB();\n    const res = await db.setOverride(rowToSend);\n    if (!res.success) return res;\n\n    // TODO: too broad — purges every cached route on any single-field save.\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: save failed\", e);\n    return { success: false, error: \"Database write failed.\" };\n  }\n}\n\n/* --------------------------------------------------------------- media --- */\n\n// SVG is excluded on purpose: it can carry script, and next/image refuses it\n// by default anyway.\nconst IMAGE_TYPES = [\"image/png\", \"image/jpeg\", \"image/webp\", \"image/gif\", \"image/avif\"];\nconst MAX_UPLOAD_BYTES = 10 * 1024 * 1024;\n\n/**\n * Authorizes an upload and returns where the browser should send the bytes.\n * Only metadata comes through here — the file itself goes straight to storage.\n */\nexport async function createAssetUpload(file: {\n  name: string;\n  contentType: string;\n  size: number;\n}): Promise<\n  { success: true; target: GRUploadTarget } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  const storage = getStorage();\n  if (!storage) {\n    return { success: false, error: \"No storage adapter is configured.\" };\n  }\n  if (!IMAGE_TYPES.includes(file.contentType)) {\n    return { success: false, error: \"Upload a PNG, JPEG, WebP, GIF, or AVIF image.\" };\n  }\n  if (!(file.size > 0) || file.size > MAX_UPLOAD_BYTES) {\n    return { success: false, error: \"Images must be under 10 MB.\" };\n  }\n\n  try {\n    const target = await storage.createUpload(await resolveSiteId(), file);\n    return { success: true, target };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: createUpload failed\", e);\n    // Failures here are almost always setup (missing SQL, bucket, or policy),\n    // so show the cause while developing. Production keeps it generic rather\n    // than exposing backend detail to editors.\n    const detail =\n      process.env.NODE_ENV !== \"production\" && e instanceof Error\n        ? ` ${e.message}`\n        : \"\";\n    return { success: false, error: `Could not start the upload.${detail}` };\n  }\n}\n\nexport async function listAssets(): Promise<GRAsset[]> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  const storage = getStorage();\n  if (!viewer || !storage) return [];\n  return storage.listAssets(await resolveSiteId());\n}\n\n/* ---------------------------------------------------------------- team --- */\n\nexport async function listTeam(): Promise<GRMember[]> {\n  // Any member may see who else is on the site; only admins may change it.\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return [];\n\n  const members = getMembers();\n  return members.listMembers(await resolveSiteId());\n}\n\nexport async function inviteMember(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const normalized = email.toLowerCase().trim();\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(normalized)) {\n    return { success: false, error: \"Enter a valid email address.\" };\n  }\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const existing = await members.getMember(siteId, { email: normalized });\n  if (existing?.status === \"active\") {\n    return { success: false, error: \"That address is already on the team.\" };\n  }\n\n  // A pending invite is re-sent rather than rejected: provider email is\n  // rate-limited and unreliable enough that resending has to be possible.\n  if (!existing) {\n    const res = await members.upsertMember(siteId, {\n      email: normalized,\n      role,\n      userId: null,\n      status: \"pending\",\n    });\n    if (!res.success) return res;\n  }\n\n  const auth = getAuth();\n  if (auth.inviteUser) {\n    // The membership is already written; a failed send must not undo it.\n    const sent = await auth.inviteUser(normalized, {\n      redirectTo: `${await requestOrigin()}/?edit=true`,\n    });\n    revalidatePath(\"/\", \"layout\");\n    return sent.success\n      ? { success: true }\n      : {\n          success: false,\n          error: `Invite saved, but the email failed: ${sent.error}`,\n        };\n  }\n\n  // No provider-side delivery, so hand off to the app.\n  try {\n    await getInviteHandler()?.({\n      email: normalized,\n      role: existing?.role ?? role,\n      siteId,\n      invitedBy: viewer.email ?? viewer.userId,\n    });\n  } catch (e) {\n    console.error(\"Guardrail: onInvite handler threw\", e);\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\nexport async function updateMemberRole(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const target = await members.getMember(siteId, {\n    email: email.toLowerCase().trim(),\n  });\n  if (!target) return { success: false, error: \"No such member.\" };\n\n  if (target.role === \"admin\" && role !== \"admin\") {\n    const guard = await wouldStrandSite(siteId, target.email);\n    if (guard) return guard;\n  }\n\n  const res = await members.upsertMember(siteId, {\n    email: target.email,\n    role,\n    userId: target.userId,\n    status: target.status,\n  });\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nexport async function removeMember(email: string): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n  const normalized = email.toLowerCase().trim();\n\n  const guard = await wouldStrandSite(siteId, normalized);\n  if (guard) return guard;\n\n  const res = await members.removeMember(siteId, normalized);\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nasync function requestOrigin(): Promise<string> {\n  const h = await headers();\n  const origin = h.get(\"origin\");\n  if (origin) return origin;\n  const host = h.get(\"x-forwarded-host\") ?? h.get(\"host\") ?? \"localhost\";\n  const proto = h.get(\"x-forwarded-proto\") ?? (host.startsWith(\"localhost\") ? \"http\" : \"https\");\n  return `${proto}://${host}`;\n}\n\n/**\n * Refuses changes that would leave a site with no admin, which would lock\n * everyone out of team management with no in-app way to recover.\n */\nasync function wouldStrandSite(\n  siteId: string,\n  email: string,\n): Promise<Result | null> {\n  const members = getMembers();\n  const all = await members.listMembers(siteId);\n  const admins = all.filter((m) => m.role === \"admin\");\n\n  if (admins.length <= 1 && admins.some((m) => m.email === email)) {\n    return {\n      success: false,\n      error: \"A site must keep at least one admin.\",\n    };\n  }\n  return null;\n}\n\n/* ---------------------------------------------------------------- auth --- */\n\nexport async function loginAction(\n  _prev: ActionState,\n  formData: FormData,\n): Promise<ActionState> {\n  const email = String(formData.get(\"email\") ?? \"\");\n  const password = String(formData.get(\"password\") ?? \"\");\n\n  const auth = getAuth();\n  if (!auth.authenticate) {\n    return {\n      success: false,\n      error: \"This site's auth provider does not accept passwords.\",\n      email,\n    };\n  }\n\n  const result = await auth.authenticate(email, password);\n  if (!result.success) {\n    return { success: false, error: result.error, email };\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true, email };\n}\n\nexport async function logoutAction(): Promise<{ success: boolean }> {\n  const auth = getAuth();\n  await auth.logout();\n  // Cleared here, not by the client afterward: a Server Action's own\n  // revalidatePath() below triggers Next's router to refresh the current\n  // route automatically, which can race a client-side navigation attempted\n  // right after this resolves — confirmed live, where that automatic\n  // refresh (for the pre-logout URL, ?edit=true) won the race and silently\n  // undid a client-side `window.location.href` to the plain path. Deleting\n  // the cookie here instead makes it part of the one server round-trip that\n  // revalidatePath already accounts for, with nothing left to race.\n  const cookieStore = await cookies();\n  cookieStore.delete(GR_COOKIES.EDIT_MODE);\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\n/* ---------------------------------------------------------- redirects --- */\n\n/**\n * Completes a session that arrived via an invite, magic-link, or\n * password-recovery redirect. Called by AuthRedirectSync (react/), the\n * generic client component that notices this kind of link and hands off\n * whatever it found in the URL — the actual token exchange is entirely the\n * auth adapter's job (see GRAuthAdapter.completeAuthRedirect); core only\n * orchestrates the result.\n *\n * A no-op {success:false}, not an error, when the adapter doesn't implement\n * this — most page loads carry no redirect data at all, and an adapter with\n * no such concept should not make every one of them fail.\n */\nexport async function completeAuthRedirectAction(\n  params: AuthRedirectParams,\n): Promise<{ success: boolean; needsPassword?: boolean; error?: string }> {\n  const auth = getAuth();\n  if (!auth.completeAuthRedirect) return { success: false };\n\n  const res = await auth.completeAuthRedirect(params);\n  if (res.success) {\n    if (res.needsPassword) {\n      const cookieStore = await cookies();\n      cookieStore.set(GR_COOKIES.NEEDS_PASSWORD, \"true\", {\n        path: \"/\",\n        maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS,\n      });\n    }\n    revalidatePath(\"/\", \"layout\");\n  }\n  return res;\n}\n\n/**\n * Sets the current session's password — the prompt completeAuthRedirectAction\n * triggers via needsPassword. Requires only a valid session, not a role: an\n * invited person's role is claimed as a side effect of getCachedViewer()\n * resolving them, which already happens independently of this.\n */\nexport async function setPasswordAction(\n  _prev: SetPasswordState,\n  formData: FormData,\n): Promise<SetPasswordState> {\n  const viewer = await getCachedViewer();\n  if (!viewer) return { success: false, error: \"Not signed in.\" };\n\n  const auth = getAuth();\n  if (!auth.setPassword) {\n    return { success: false, error: \"This site's auth provider does not support setting a password.\" };\n  }\n\n  const password = String(formData.get(\"password\") ?? \"\");\n  const res = await auth.setPassword(password);\n  if (res.success) {\n    const cookieStore = await cookies();\n    cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);\n    revalidatePath(\"/\", \"layout\");\n  }\n  return res;\n}\n\n/** Dismisses the set-password prompt without setting one — see Admin.tsx. */\nexport async function skipSetPasswordAction(): Promise<{ success: boolean }> {\n  const cookieStore = await cookies();\n  cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,SAAS,eAAe;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,YAAY,qCAAqC;AAkB1D,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAOhE,eAAsB,YACpB,SAC0B;AAC1B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,eAAsB,aAAa,KAAmC;AACpE,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,YAA0B;AAAA,IAC9B,SAAS,IAAI;AAAA,IACb,QAAQ,MAAM,cAAc;AAAA,IAC5B,MAAM,IAAI,MAAM;AAAA,IAChB,OAAO,IAAI;AAAA,EACb;AAEA,MAAI;AACF,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,MAAM,GAAG,YAAY,SAAS;AAC1C,QAAI,CAAC,IAAI,QAAS,QAAO;AAGzB,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0BAA0B,CAAC;AACzC,WAAO,EAAE,SAAS,OAAO,OAAO,yBAAyB;AAAA,EAC3D;AACF;AAMA,MAAM,cAAc,CAAC,aAAa,cAAc,cAAc,aAAa,YAAY;AACvF,MAAM,mBAAmB,KAAK,OAAO;AAMrC,eAAsB,kBAAkB,MAMtC;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,oCAAoC;AAAA,EACtE;AACA,MAAI,CAAC,YAAY,SAAS,KAAK,WAAW,GAAG;AAC3C,WAAO,EAAE,SAAS,OAAO,OAAO,gDAAgD;AAAA,EAClF;AACA,MAAI,EAAE,KAAK,OAAO,MAAM,KAAK,OAAO,kBAAkB;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B;AAAA,EAChE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,cAAc,GAAG,IAAI;AACrE,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,kCAAkC,CAAC;AAIjD,UAAM,SACJ,QAAQ,IAAI,aAAa,gBAAgB,aAAa,QAClD,IAAI,EAAE,OAAO,KACb;AACN,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B,MAAM,GAAG;AAAA,EACzE;AACF;AAEA,eAAsB,aAAiC;AACrD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO,CAAC;AACjC,SAAO,QAAQ,WAAW,MAAM,cAAc,CAAC;AACjD;AAIA,eAAsB,WAAgC;AAEpD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,UAAU,WAAW;AAC3B,SAAO,QAAQ,YAAY,MAAM,cAAc,CAAC;AAClD;AAEA,eAAsB,aACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAC5C,MAAI,CAAC,6BAA6B,KAAK,UAAU,GAAG;AAClD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AAEA,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,EAAE,OAAO,WAAW,CAAC;AACtE,MAAI,UAAU,WAAW,UAAU;AACjC,WAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,EACzE;AAIA,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,MAC7C,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,QAAS,QAAO;AAAA,EAC3B;AAEA,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,YAAY;AAEnB,UAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAAA,MAC7C,YAAY,GAAG,MAAM,cAAc,CAAC;AAAA,IACtC,CAAC;AACD,mBAAe,KAAK,QAAQ;AAC5B,WAAO,KAAK,UACR,EAAE,SAAS,KAAK,IAChB;AAAA,MACE,SAAS;AAAA,MACT,OAAO,uCAAuC,KAAK,KAAK;AAAA,IAC1D;AAAA,EACN;AAGA,MAAI;AACF,UAAM,iBAAiB,IAAI;AAAA,MACzB,OAAO;AAAA,MACP,MAAM,UAAU,QAAQ;AAAA,MACxB;AAAA,MACA,WAAW,OAAO,SAAS,OAAO;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,GAAG;AACV,YAAQ,MAAM,qCAAqC,CAAC;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAsB,iBACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ;AAAA,IAC7C,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAE/D,MAAI,OAAO,SAAS,WAAW,SAAS,SAAS;AAC/C,UAAM,QAAQ,MAAM,gBAAgB,QAAQ,OAAO,KAAK;AACxD,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,IAC7C,OAAO,OAAO;AAAA,IACd;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAsB,aAAa,OAAgC;AACjE,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAE5C,QAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,MAAI,MAAO,QAAO;AAElB,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ,UAAU;AACzD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAe,gBAAiC;AAC9C,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,QAAQ;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,OAAO,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,MAAM,KAAK;AAC3D,QAAM,QAAQ,EAAE,IAAI,mBAAmB,MAAM,KAAK,WAAW,WAAW,IAAI,SAAS;AACrF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAMA,eAAe,gBACb,QACA,OACwB;AACxB,QAAM,UAAU,WAAW;AAC3B,QAAM,MAAM,MAAM,QAAQ,YAAY,MAAM;AAC5C,QAAM,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO;AAEnD,MAAI,OAAO,UAAU,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIA,eAAsB,YACpB,OACA,UACsB;AACtB,QAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAChD,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AAEtD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,cAAc;AACtB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,KAAK,aAAa,OAAO,QAAQ;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,SAAS,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,MAAM,MAAM;AAChC;AAEA,eAAsB,eAA8C;AAClE,QAAM,OAAO,QAAQ;AACrB,QAAM,KAAK,OAAO;AASlB,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,WAAW,SAAS;AACvC,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAgBA,eAAsB,2BACpB,QACwE;AACxE,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,qBAAsB,QAAO,EAAE,SAAS,MAAM;AAExD,QAAM,MAAM,MAAM,KAAK,qBAAqB,MAAM;AAClD,MAAI,IAAI,SAAS;AACf,QAAI,IAAI,eAAe;AACrB,YAAM,cAAc,MAAM,QAAQ;AAClC,kBAAY,IAAI,WAAW,gBAAgB,QAAQ;AAAA,QACjD,MAAM;AAAA,QACN,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,mBAAe,KAAK,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAQA,eAAsB,kBACpB,OACA,UAC2B;AAC3B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAE9D,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,aAAa;AACrB,WAAO,EAAE,SAAS,OAAO,OAAO,iEAAiE;AAAA,EACnG;AAEA,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AACtD,QAAM,MAAM,MAAM,KAAK,YAAY,QAAQ;AAC3C,MAAI,IAAI,SAAS;AACf,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,OAAO,WAAW,cAAc;AAC5C,mBAAe,KAAK,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAGA,eAAsB,wBAAuD;AAC3E,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,WAAW,cAAc;AAC5C,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;","names":[]}
+{"version":3,"sources":["../../src/server/actions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { cookies, headers } from \"next/headers\";\nimport {\n  getAuth,\n  getDB,\n  getInviteHandler,\n  getMembers,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { requireRole } from \"./access\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from \"../core/defs\";\nimport type {\n  ActionState,\n  GRAsset,\n  GRMember,\n  GRRole,\n  OverrideRow,\n  OverrideType,\n  OverrideValue,\n  SetPasswordState,\n} from \"../core/types\";\nimport type {\n  AuthRedirectParams,\n  GRStorageRow,\n  GRUploadTarget,\n} from \"../core/adapter-types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\n// Every mutation below re-resolves the viewer server-side through\n// requireRole() (see access.ts) — the client's copy of the role decides what\n// to *show*, never what is *allowed*.\n\nexport async function saveOverride(row: OverrideRow): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n  return writeOverride(row.pathKey, row.value);\n}\n\nconst OVERRIDE_TYPES: readonly OverrideType[] = [\"text\", \"link\", \"image\", \"button\"];\n\n/**\n * Writes one field's value by id, with no <GRail> involved — the setter that\n * pairs with getFieldValue(). It exists for fields with nothing on the page to\n * click: an SEO title or meta description, an og:image, a product's stock\n * note. Build a drawer or form of your own, and have it (or a Server Action of\n * yours) call this.\n *\n * A bare string is shorthand for a text field. Pass an OverrideValue for the\n * other types ({ type: \"image\", src, alt }, a link, a button).\n *\n * Does its own role check — an editor or admin — so it is safe to call\n * directly from a Client Component, the same as saveOverride. If your own\n * action does other work first, check isEditor() there too.\n *\n * Writes the same row a <GRail> with this id would, so the two stay\n * interchangeable: a field first written here can later be given a visible\n * <GRail>, and vice versa.\n */\nexport async function setFieldValue(\n  id: string,\n  value: string | OverrideValue,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  const pathKey = id.trim();\n  if (!pathKey) return { success: false, error: \"A field id is required.\" };\n\n  const normalized: OverrideValue =\n    typeof value === \"string\" ? { type: \"text\", text: value } : value;\n  if (!OVERRIDE_TYPES.includes(normalized.type)) {\n    return { success: false, error: `Unknown field type \"${normalized.type}\".` };\n  }\n\n  return writeOverride(pathKey, normalized);\n}\n\n/** The write shared by saveOverride and setFieldValue; the caller has already authorized. */\nasync function writeOverride(\n  pathKey: string,\n  value: OverrideValue,\n): Promise<Result> {\n  const rowToSend: GRStorageRow = {\n    pathKey,\n    siteId: await resolveSiteId(),\n    type: value.type,\n    value,\n  };\n\n  try {\n    const db = getDB();\n    const res = await db.setOverride(rowToSend);\n    if (!res.success) return res;\n\n    // TODO: too broad — purges every cached route on any single-field save.\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: save failed\", e);\n    return { success: false, error: \"Database write failed.\" };\n  }\n}\n\n/* --------------------------------------------------------------- media --- */\n\n// SVG is excluded on purpose: it can carry script, and next/image refuses it\n// by default anyway.\nconst IMAGE_TYPES = [\"image/png\", \"image/jpeg\", \"image/webp\", \"image/gif\", \"image/avif\"];\nconst MAX_UPLOAD_BYTES = 10 * 1024 * 1024;\n\n/**\n * Authorizes an upload and returns where the browser should send the bytes.\n * Only metadata comes through here — the file itself goes straight to storage.\n */\nexport async function createAssetUpload(file: {\n  name: string;\n  contentType: string;\n  size: number;\n}): Promise<\n  { success: true; target: GRUploadTarget } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  const storage = getStorage();\n  if (!storage) {\n    return { success: false, error: \"No storage adapter is configured.\" };\n  }\n  if (!IMAGE_TYPES.includes(file.contentType)) {\n    return { success: false, error: \"Upload a PNG, JPEG, WebP, GIF, or AVIF image.\" };\n  }\n  if (!(file.size > 0) || file.size > MAX_UPLOAD_BYTES) {\n    return { success: false, error: \"Images must be under 10 MB.\" };\n  }\n\n  try {\n    const target = await storage.createUpload(await resolveSiteId(), file);\n    return { success: true, target };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: createUpload failed\", e);\n    // Failures here are almost always setup (missing SQL, bucket, or policy),\n    // so show the cause while developing. Production keeps it generic rather\n    // than exposing backend detail to editors.\n    const detail =\n      process.env.NODE_ENV !== \"production\" && e instanceof Error\n        ? ` ${e.message}`\n        : \"\";\n    return { success: false, error: `Could not start the upload.${detail}` };\n  }\n}\n\nexport async function listAssets(): Promise<GRAsset[]> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  const storage = getStorage();\n  if (!viewer || !storage) return [];\n  return storage.listAssets(await resolveSiteId());\n}\n\n/* ---------------------------------------------------------------- team --- */\n\nexport async function listTeam(): Promise<GRMember[]> {\n  // Any member may see who else is on the site; only admins may change it.\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return [];\n\n  const members = getMembers();\n  return members.listMembers(await resolveSiteId());\n}\n\nexport async function inviteMember(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const normalized = email.toLowerCase().trim();\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(normalized)) {\n    return { success: false, error: \"Enter a valid email address.\" };\n  }\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const existing = await members.getMember(siteId, { email: normalized });\n  if (existing?.status === \"active\") {\n    return { success: false, error: \"That address is already on the team.\" };\n  }\n\n  // A pending invite is re-sent rather than rejected: provider email is\n  // rate-limited and unreliable enough that resending has to be possible.\n  if (!existing) {\n    const res = await members.upsertMember(siteId, {\n      email: normalized,\n      role,\n      userId: null,\n      status: \"pending\",\n    });\n    if (!res.success) return res;\n  }\n\n  const auth = getAuth();\n  if (auth.inviteUser) {\n    // The membership is already written; a failed send must not undo it.\n    const sent = await auth.inviteUser(normalized, {\n      redirectTo: `${await requestOrigin()}/?edit=true`,\n    });\n    revalidatePath(\"/\", \"layout\");\n    return sent.success\n      ? { success: true }\n      : {\n          success: false,\n          error: `Invite saved, but the email failed: ${sent.error}`,\n        };\n  }\n\n  // No provider-side delivery, so hand off to the app.\n  try {\n    await getInviteHandler()?.({\n      email: normalized,\n      role: existing?.role ?? role,\n      siteId,\n      invitedBy: viewer.email ?? viewer.userId,\n    });\n  } catch (e) {\n    console.error(\"Guardrail: onInvite handler threw\", e);\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\nexport async function updateMemberRole(\n  email: string,\n  role: GRRole,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n\n  const target = await members.getMember(siteId, {\n    email: email.toLowerCase().trim(),\n  });\n  if (!target) return { success: false, error: \"No such member.\" };\n\n  if (target.role === \"admin\" && role !== \"admin\") {\n    const guard = await wouldStrandSite(siteId, target.email);\n    if (guard) return guard;\n  }\n\n  const res = await members.upsertMember(siteId, {\n    email: target.email,\n    role,\n    userId: target.userId,\n    status: target.status,\n  });\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nexport async function removeMember(email: string): Promise<Result> {\n  const viewer = await requireRole([\"admin\"]);\n  if (!viewer) return DENIED;\n\n  const siteId = await resolveSiteId();\n  const members = getMembers();\n  const normalized = email.toLowerCase().trim();\n\n  const guard = await wouldStrandSite(siteId, normalized);\n  if (guard) return guard;\n\n  const res = await members.removeMember(siteId, normalized);\n  if (res.success) revalidatePath(\"/\", \"layout\");\n  return res;\n}\n\nasync function requestOrigin(): Promise<string> {\n  const h = await headers();\n  const origin = h.get(\"origin\");\n  if (origin) return origin;\n  const host = h.get(\"x-forwarded-host\") ?? h.get(\"host\") ?? \"localhost\";\n  const proto = h.get(\"x-forwarded-proto\") ?? (host.startsWith(\"localhost\") ? \"http\" : \"https\");\n  return `${proto}://${host}`;\n}\n\n/**\n * Refuses changes that would leave a site with no admin, which would lock\n * everyone out of team management with no in-app way to recover.\n */\nasync function wouldStrandSite(\n  siteId: string,\n  email: string,\n): Promise<Result | null> {\n  const members = getMembers();\n  const all = await members.listMembers(siteId);\n  const admins = all.filter((m) => m.role === \"admin\");\n\n  if (admins.length <= 1 && admins.some((m) => m.email === email)) {\n    return {\n      success: false,\n      error: \"A site must keep at least one admin.\",\n    };\n  }\n  return null;\n}\n\n/* ---------------------------------------------------------------- auth --- */\n\nexport async function loginAction(\n  _prev: ActionState,\n  formData: FormData,\n): Promise<ActionState> {\n  const email = String(formData.get(\"email\") ?? \"\");\n  const password = String(formData.get(\"password\") ?? \"\");\n\n  const auth = getAuth();\n  if (!auth.authenticate) {\n    return {\n      success: false,\n      error: \"This site's auth provider does not accept passwords.\",\n      email,\n    };\n  }\n\n  const result = await auth.authenticate(email, password);\n  if (!result.success) {\n    return { success: false, error: result.error, email };\n  }\n\n  revalidatePath(\"/\", \"layout\");\n  return { success: true, email };\n}\n\nexport async function logoutAction(): Promise<{ success: boolean }> {\n  const auth = getAuth();\n  await auth.logout();\n  // Cleared here, not by the client afterward: a Server Action's own\n  // revalidatePath() below triggers Next's router to refresh the current\n  // route automatically, which can race a client-side navigation attempted\n  // right after this resolves — confirmed live, where that automatic\n  // refresh (for the pre-logout URL, ?edit=true) won the race and silently\n  // undid a client-side `window.location.href` to the plain path. Deleting\n  // the cookie here instead makes it part of the one server round-trip that\n  // revalidatePath already accounts for, with nothing left to race.\n  const cookieStore = await cookies();\n  cookieStore.delete(GR_COOKIES.EDIT_MODE);\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n\n/* ---------------------------------------------------------- redirects --- */\n\n/**\n * Completes a session that arrived via an invite, magic-link, or\n * password-recovery redirect. Called by AuthRedirectSync (react/), the\n * generic client component that notices this kind of link and hands off\n * whatever it found in the URL — the actual token exchange is entirely the\n * auth adapter's job (see GRAuthAdapter.completeAuthRedirect); core only\n * orchestrates the result.\n *\n * A no-op {success:false}, not an error, when the adapter doesn't implement\n * this — most page loads carry no redirect data at all, and an adapter with\n * no such concept should not make every one of them fail.\n */\nexport async function completeAuthRedirectAction(\n  params: AuthRedirectParams,\n): Promise<{ success: boolean; needsPassword?: boolean; error?: string }> {\n  const auth = getAuth();\n  if (!auth.completeAuthRedirect) return { success: false };\n\n  const res = await auth.completeAuthRedirect(params);\n  if (res.success) {\n    if (res.needsPassword) {\n      const cookieStore = await cookies();\n      cookieStore.set(GR_COOKIES.NEEDS_PASSWORD, \"true\", {\n        path: \"/\",\n        maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS,\n      });\n    }\n    revalidatePath(\"/\", \"layout\");\n  }\n  return res;\n}\n\n/**\n * Sets the current session's password — the prompt completeAuthRedirectAction\n * triggers via needsPassword. Requires only a valid session, not a role: an\n * invited person's role is claimed as a side effect of getCachedViewer()\n * resolving them, which already happens independently of this.\n */\nexport async function setPasswordAction(\n  _prev: SetPasswordState,\n  formData: FormData,\n): Promise<SetPasswordState> {\n  const viewer = await getCachedViewer();\n  if (!viewer) return { success: false, error: \"Not signed in.\" };\n\n  const auth = getAuth();\n  if (!auth.setPassword) {\n    return { success: false, error: \"This site's auth provider does not support setting a password.\" };\n  }\n\n  const password = String(formData.get(\"password\") ?? \"\");\n  const res = await auth.setPassword(password);\n  if (res.success) {\n    const cookieStore = await cookies();\n    cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);\n    revalidatePath(\"/\", \"layout\");\n  }\n  return res;\n}\n\n/** Dismisses the set-password prompt without setting one — see Admin.tsx. */\nexport async function skipSetPasswordAction(): Promise<{ success: boolean }> {\n  const cookieStore = await cookies();\n  cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);\n  revalidatePath(\"/\", \"layout\");\n  return { success: true };\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,SAAS,eAAe;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AACjC,SAAS,YAAY,qCAAqC;AAmB1D,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAMhE,eAAsB,aAAa,KAAmC;AACpE,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,cAAc,IAAI,SAAS,IAAI,KAAK;AAC7C;AAEA,MAAM,iBAA0C,CAAC,QAAQ,QAAQ,SAAS,QAAQ;AAoBlF,eAAsB,cACpB,IACA,OACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,UAAU,GAAG,KAAK;AACxB,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAExE,QAAM,aACJ,OAAO,UAAU,WAAW,EAAE,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9D,MAAI,CAAC,eAAe,SAAS,WAAW,IAAI,GAAG;AAC7C,WAAO,EAAE,SAAS,OAAO,OAAO,uBAAuB,WAAW,IAAI,KAAK;AAAA,EAC7E;AAEA,SAAO,cAAc,SAAS,UAAU;AAC1C;AAGA,eAAe,cACb,SACA,OACiB;AACjB,QAAM,YAA0B;AAAA,IAC9B;AAAA,IACA,QAAQ,MAAM,cAAc;AAAA,IAC5B,MAAM,MAAM;AAAA,IACZ;AAAA,EACF;AAEA,MAAI;AACF,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,MAAM,GAAG,YAAY,SAAS;AAC1C,QAAI,CAAC,IAAI,QAAS,QAAO;AAGzB,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0BAA0B,CAAC;AACzC,WAAO,EAAE,SAAS,OAAO,OAAO,yBAAyB;AAAA,EAC3D;AACF;AAMA,MAAM,cAAc,CAAC,aAAa,cAAc,cAAc,aAAa,YAAY;AACvF,MAAM,mBAAmB,KAAK,OAAO;AAMrC,eAAsB,kBAAkB,MAMtC;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,oCAAoC;AAAA,EACtE;AACA,MAAI,CAAC,YAAY,SAAS,KAAK,WAAW,GAAG;AAC3C,WAAO,EAAE,SAAS,OAAO,OAAO,gDAAgD;AAAA,EAClF;AACA,MAAI,EAAE,KAAK,OAAO,MAAM,KAAK,OAAO,kBAAkB;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B;AAAA,EAChE;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa,MAAM,cAAc,GAAG,IAAI;AACrE,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,kCAAkC,CAAC;AAIjD,UAAM,SACJ,QAAQ,IAAI,aAAa,gBAAgB,aAAa,QAClD,IAAI,EAAE,OAAO,KACb;AACN,WAAO,EAAE,SAAS,OAAO,OAAO,8BAA8B,MAAM,GAAG;AAAA,EACzE;AACF;AAEA,eAAsB,aAAiC;AACrD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,UAAU,CAAC,QAAS,QAAO,CAAC;AACjC,SAAO,QAAQ,WAAW,MAAM,cAAc,CAAC;AACjD;AAIA,eAAsB,WAAgC;AAEpD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,UAAU,WAAW;AAC3B,SAAO,QAAQ,YAAY,MAAM,cAAc,CAAC;AAClD;AAEA,eAAsB,aACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAC5C,MAAI,CAAC,6BAA6B,KAAK,UAAU,GAAG;AAClD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AAEA,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,EAAE,OAAO,WAAW,CAAC;AACtE,MAAI,UAAU,WAAW,UAAU;AACjC,WAAO,EAAE,SAAS,OAAO,OAAO,uCAAuC;AAAA,EACzE;AAIA,MAAI,CAAC,UAAU;AACb,UAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,MAC7C,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,CAAC,IAAI,QAAS,QAAO;AAAA,EAC3B;AAEA,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,YAAY;AAEnB,UAAM,OAAO,MAAM,KAAK,WAAW,YAAY;AAAA,MAC7C,YAAY,GAAG,MAAM,cAAc,CAAC;AAAA,IACtC,CAAC;AACD,mBAAe,KAAK,QAAQ;AAC5B,WAAO,KAAK,UACR,EAAE,SAAS,KAAK,IAChB;AAAA,MACE,SAAS;AAAA,MACT,OAAO,uCAAuC,KAAK,KAAK;AAAA,IAC1D;AAAA,EACN;AAGA,MAAI;AACF,UAAM,iBAAiB,IAAI;AAAA,MACzB,OAAO;AAAA,MACP,MAAM,UAAU,QAAQ;AAAA,MACxB;AAAA,MACA,WAAW,OAAO,SAAS,OAAO;AAAA,IACpC,CAAC;AAAA,EACH,SAAS,GAAG;AACV,YAAQ,MAAM,qCAAqC,CAAC;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAEA,eAAsB,iBACpB,OACA,MACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAE3B,QAAM,SAAS,MAAM,QAAQ,UAAU,QAAQ;AAAA,IAC7C,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,EAClC,CAAC;AACD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,kBAAkB;AAE/D,MAAI,OAAO,SAAS,WAAW,SAAS,SAAS;AAC/C,UAAM,QAAQ,MAAM,gBAAgB,QAAQ,OAAO,KAAK;AACxD,QAAI,MAAO,QAAO;AAAA,EACpB;AAEA,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ;AAAA,IAC7C,OAAO,OAAO;AAAA,IACd;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAsB,aAAa,OAAgC;AACjE,QAAM,SAAS,MAAM,YAAY,CAAC,OAAO,CAAC;AAC1C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,UAAU,WAAW;AAC3B,QAAM,aAAa,MAAM,YAAY,EAAE,KAAK;AAE5C,QAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,MAAI,MAAO,QAAO;AAElB,QAAM,MAAM,MAAM,QAAQ,aAAa,QAAQ,UAAU;AACzD,MAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,SAAO;AACT;AAEA,eAAe,gBAAiC;AAC9C,QAAM,IAAI,MAAM,QAAQ;AACxB,QAAM,SAAS,EAAE,IAAI,QAAQ;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,OAAO,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,MAAM,KAAK;AAC3D,QAAM,QAAQ,EAAE,IAAI,mBAAmB,MAAM,KAAK,WAAW,WAAW,IAAI,SAAS;AACrF,SAAO,GAAG,KAAK,MAAM,IAAI;AAC3B;AAMA,eAAe,gBACb,QACA,OACwB;AACxB,QAAM,UAAU,WAAW;AAC3B,QAAM,MAAM,MAAM,QAAQ,YAAY,MAAM;AAC5C,QAAM,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO;AAEnD,MAAI,OAAO,UAAU,KAAK,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIA,eAAsB,YACpB,OACA,UACsB;AACtB,QAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,EAAE;AAChD,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AAEtD,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,cAAc;AACtB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,KAAK,aAAa,OAAO,QAAQ;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,SAAS,OAAO,OAAO,OAAO,OAAO,MAAM;AAAA,EACtD;AAEA,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,MAAM,MAAM;AAChC;AAEA,eAAsB,eAA8C;AAClE,QAAM,OAAO,QAAQ;AACrB,QAAM,KAAK,OAAO;AASlB,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,WAAW,SAAS;AACvC,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;AAgBA,eAAsB,2BACpB,QACwE;AACxE,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,qBAAsB,QAAO,EAAE,SAAS,MAAM;AAExD,QAAM,MAAM,MAAM,KAAK,qBAAqB,MAAM;AAClD,MAAI,IAAI,SAAS;AACf,QAAI,IAAI,eAAe;AACrB,YAAM,cAAc,MAAM,QAAQ;AAClC,kBAAY,IAAI,WAAW,gBAAgB,QAAQ;AAAA,QACjD,MAAM;AAAA,QACN,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AACA,mBAAe,KAAK,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAQA,eAAsB,kBACpB,OACA,UAC2B;AAC3B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAE9D,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,KAAK,aAAa;AACrB,WAAO,EAAE,SAAS,OAAO,OAAO,iEAAiE;AAAA,EACnG;AAEA,QAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE;AACtD,QAAM,MAAM,MAAM,KAAK,YAAY,QAAQ;AAC3C,MAAI,IAAI,SAAS;AACf,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,OAAO,WAAW,cAAc;AAC5C,mBAAe,KAAK,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAGA,eAAsB,wBAAuD;AAC3E,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,WAAW,cAAc;AAC5C,iBAAe,KAAK,QAAQ;AAC5B,SAAO,EAAE,SAAS,KAAK;AACzB;","names":[]}

package/dist/server/fieldData.d.ts

@@ -10,8 +10,10 @@ import 'react';
  * config.
  *
  * Read-only: this does not make a field editable on its own. Give the same
- * id a normal <GRail> somewhere for an editor to change it; this just reads
- * whatever that field currently holds.
+ * id a normal <GRail> somewhere for an editor to change it, or — for a field
+ * with nothing on the page to click, like a meta description — build your own
+ * editing UI around setFieldValue(). This just reads whatever the field
+ * currently holds.
  *
  * Shares <GRail>'s request-scoped batching loader, so calling this alongside
  * other fields — including several of these via Promise.all — still resolves

package/dist/server/fieldData.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/fieldData.ts"],"sourcesContent":["import { loadOverride } from \"./loader\";\nimport type { OverrideValue } from \"../core/types\";\n\n/**\n * Reads a field's current value with no rendering attached.\n *\n * <GRail> covers \"render this as an editable element.\" This covers \"give me\n * the data so I can build something GRail doesn't render itself\" — an embed\n * iframe's src, an og:image meta tag, structured data, a third-party widget's\n * config.\n *\n * Read-only: this does not make a field editable on its own. Give the same\n * id a normal <GRail> somewhere for an editor to change it; this just reads\n * whatever that field currently holds.\n *\n * Shares <GRail>'s request-scoped batching loader, so calling this alongside\n * other fields — including several of these via Promise.all — still resolves\n * in one query, not one per call.\n *\n * Returns null when nothing has been saved yet. There is no `children`\n * fallback to fall back to here, since nothing is rendered — supply your own\n * default in the calling code.\n */\nexport async function getFieldValue(id: string): Promise<OverrideValue | null> {\n  const row = await loadOverride(id);\n  return row?.value ?? null;\n}\n"],"mappings":"AAAA,SAAS,oBAAoB;AAuB7B,eAAsB,cAAc,IAA2C;AAC7E,QAAM,MAAM,MAAM,aAAa,EAAE;AACjC,SAAO,KAAK,SAAS;AACvB;","names":[]}
+{"version":3,"sources":["../../src/server/fieldData.ts"],"sourcesContent":["import { loadOverride } from \"./loader\";\nimport type { OverrideValue } from \"../core/types\";\n\n/**\n * Reads a field's current value with no rendering attached.\n *\n * <GRail> covers \"render this as an editable element.\" This covers \"give me\n * the data so I can build something GRail doesn't render itself\" — an embed\n * iframe's src, an og:image meta tag, structured data, a third-party widget's\n * config.\n *\n * Read-only: this does not make a field editable on its own. Give the same\n * id a normal <GRail> somewhere for an editor to change it, or — for a field\n * with nothing on the page to click, like a meta description — build your own\n * editing UI around setFieldValue(). This just reads whatever the field\n * currently holds.\n *\n * Shares <GRail>'s request-scoped batching loader, so calling this alongside\n * other fields — including several of these via Promise.all — still resolves\n * in one query, not one per call.\n *\n * Returns null when nothing has been saved yet. There is no `children`\n * fallback to fall back to here, since nothing is rendered — supply your own\n * default in the calling code.\n */\nexport async function getFieldValue(id: string): Promise<OverrideValue | null> {\n  const row = await loadOverride(id);\n  return row?.value ?? null;\n}\n"],"mappings":"AAAA,SAAS,oBAAoB;AAyB7B,eAAsB,cAAc,IAA2C;AAC7E,QAAM,MAAM,MAAM,aAAa,EAAE;AACjC,SAAO,KAAK,SAAS;AACvB;","names":[]}

package/dist/server/repeaterActions.js

@@ -1,7 +1,7 @@
 "use server";
 import { revalidatePath } from "next/cache";
 import { getDB, getRepeaters, resolveSiteId } from "../core/config";
-import { requireRole } from "./actions";
+import { requireRole } from "./access";
 import { rethrowIfBailout } from "../core/bailout";
 const DENIED = { success: false, error: "Unauthorized." };
 async function addRepeaterItem(repeaterId, options) {

package/dist/server/repeaterActions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/repeaterActions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { getDB, getRepeaters, resolveSiteId } from \"../core/config\";\nimport { requireRole } from \"./actions\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRRepeaterItem } from \"../core/types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\nexport async function addRepeaterItem(\n  repeaterId: string,\n  options?: { slug?: string },\n): Promise<\n  { success: true; item: GRRepeaterItem } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  if (options?.slug !== undefined) {\n    const slug = options.slug.trim();\n    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {\n      return {\n        success: false,\n        error: \"Use lowercase letters, numbers, and hyphens only.\",\n      };\n    }\n    options = { slug };\n  }\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.addItem(repeaterId, await resolveSiteId(), options);\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: addRepeaterItem failed\", e);\n    return { success: false, error: \"Could not add the item.\" };\n  }\n}\n\nexport async function removeRepeaterItem(\n  repeaterId: string,\n  itemId: string,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const siteId = await resolveSiteId();\n    const repeaters = getRepeaters();\n    const res = await repeaters.removeItem(repeaterId, siteId, itemId);\n    if (!res.success) return res;\n\n    // Best-effort: an adapter that can't do this cheaply just leaves the old\n    // field values behind, unreachable but harmless.\n    const db = getDB();\n    await db.deleteOverrides?.(`${repeaterId}.${itemId}.`, siteId);\n\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: removeRepeaterItem failed\", e);\n    return { success: false, error: \"Could not remove the item.\" };\n  }\n}\n\nexport async function reorderRepeaterItems(\n  repeaterId: string,\n  orderedItemIds: string[],\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.reorderItems(\n      repeaterId,\n      await resolveSiteId(),\n      orderedItemIds,\n    );\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: reorderRepeaterItems failed\", e);\n    return { success: false, error: \"Could not reorder the items.\" };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,OAAO,cAAc,qBAAqB;AACnD,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AAKjC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAEhE,eAAsB,gBACpB,YACA,SAGA;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AACA,cAAU,EAAE,KAAK;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,QAAQ,YAAY,MAAM,cAAc,GAAG,OAAO;AAC9E,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,qCAAqC,CAAC;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAAA,EAC5D;AACF;AAEA,eAAsB,mBACpB,YACA,QACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,SAAS,MAAM,cAAc;AACnC,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,WAAW,YAAY,QAAQ,MAAM;AACjE,QAAI,CAAC,IAAI,QAAS,QAAO;AAIzB,UAAM,KAAK,MAAM;AACjB,UAAM,GAAG,kBAAkB,GAAG,UAAU,IAAI,MAAM,KAAK,MAAM;AAE7D,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,wCAAwC,CAAC;AACvD,WAAO,EAAE,SAAS,OAAO,OAAO,6BAA6B;AAAA,EAC/D;AACF;AAEA,eAAsB,qBACpB,YACA,gBACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA,MAAM,cAAc;AAAA,MACpB;AAAA,IACF;AACA,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0CAA0C,CAAC;AACzD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AACF;","names":[]}
+{"version":3,"sources":["../../src/server/repeaterActions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { getDB, getRepeaters, resolveSiteId } from \"../core/config\";\nimport { requireRole } from \"./access\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRRepeaterItem } from \"../core/types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\nexport async function addRepeaterItem(\n  repeaterId: string,\n  options?: { slug?: string },\n): Promise<\n  { success: true; item: GRRepeaterItem } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  if (options?.slug !== undefined) {\n    const slug = options.slug.trim();\n    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {\n      return {\n        success: false,\n        error: \"Use lowercase letters, numbers, and hyphens only.\",\n      };\n    }\n    options = { slug };\n  }\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.addItem(repeaterId, await resolveSiteId(), options);\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: addRepeaterItem failed\", e);\n    return { success: false, error: \"Could not add the item.\" };\n  }\n}\n\nexport async function removeRepeaterItem(\n  repeaterId: string,\n  itemId: string,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const siteId = await resolveSiteId();\n    const repeaters = getRepeaters();\n    const res = await repeaters.removeItem(repeaterId, siteId, itemId);\n    if (!res.success) return res;\n\n    // Best-effort: an adapter that can't do this cheaply just leaves the old\n    // field values behind, unreachable but harmless.\n    const db = getDB();\n    await db.deleteOverrides?.(`${repeaterId}.${itemId}.`, siteId);\n\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: removeRepeaterItem failed\", e);\n    return { success: false, error: \"Could not remove the item.\" };\n  }\n}\n\nexport async function reorderRepeaterItems(\n  repeaterId: string,\n  orderedItemIds: string[],\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.reorderItems(\n      repeaterId,\n      await resolveSiteId(),\n      orderedItemIds,\n    );\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: reorderRepeaterItems failed\", e);\n    return { success: false, error: \"Could not reorder the items.\" };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,OAAO,cAAc,qBAAqB;AACnD,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AAKjC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAEhE,eAAsB,gBACpB,YACA,SAGA;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AACA,cAAU,EAAE,KAAK;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,QAAQ,YAAY,MAAM,cAAc,GAAG,OAAO;AAC9E,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,qCAAqC,CAAC;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAAA,EAC5D;AACF;AAEA,eAAsB,mBACpB,YACA,QACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,SAAS,MAAM,cAAc;AACnC,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,WAAW,YAAY,QAAQ,MAAM;AACjE,QAAI,CAAC,IAAI,QAAS,QAAO;AAIzB,UAAM,KAAK,MAAM;AACjB,UAAM,GAAG,kBAAkB,GAAG,UAAU,IAAI,MAAM,KAAK,MAAM;AAE7D,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,wCAAwC,CAAC;AACvD,WAAO,EAAE,SAAS,OAAO,OAAO,6BAA6B;AAAA,EAC/D;AACF;AAEA,eAAsB,qBACpB,YACA,gBACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA,MAAM,cAAc;AAAA,MACpB;AAAA,IACF;AACA,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0CAA0C,CAAC;AACzD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AACF;","names":[]}

package/dist/server/wrapper.js

@@ -8,8 +8,8 @@ import {
   resolveSiteId
 } from "../core/config";
 import { getCachedViewer } from "./session";
+import { resolveEditMode } from "./access";
 import { loadPreloadedContent } from "./loader";
-import { GR_COOKIES } from "../core/defs";
 import { GRailProvider } from "../react/Provider";
 import { GRailAdmin } from "../react/Admin";
 function withGuardrail(LayoutComponent, config) {
@@ -22,10 +22,9 @@ function withGuardrail(LayoutComponent, config) {
       loadPreloadedContent()
     ]);
     const auth = getAuth();
-    const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;
     const isAuth = viewer !== null;
-    const needsPassword = cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === "true";
-    const isEditMode = needsPassword || (editCookie === "false" ? false : editCookie === "true" || isAuth);
+    const { isEditMode, needsPassword } = resolveEditMode(viewer, cookieStore);
+    const role = viewer?.role ?? null;
     const state = {
       storage: getStorage() !== void 0,
       auth: {
@@ -36,7 +35,8 @@ function withGuardrail(LayoutComponent, config) {
       isEditMode,
       needsPassword,
       siteId: await resolveSiteId(),
-      role: viewer?.role ?? null,
+      role,
+      canEdit: isEditMode && role !== null,
       ...viewer?.email ? { email: viewer.email } : {}
     };
     return /* @__PURE__ */ jsxs(GRailProvider, { state, content, children: [

package/dist/server/wrapper.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/wrapper.tsx"],"sourcesContent":["import React, { Suspense } from \"react\";\nimport { cookies } from \"next/headers\";\nimport {\n  configureGuardrail,\n  getAuth,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { loadPreloadedContent } from \"./loader\";\nimport type { GRConfig } from \"../core/adapter-types\";\nimport { GR_COOKIES } from \"../core/defs\";\nimport { GRailProvider } from \"../react/Provider\";\nimport { GRailAdmin } from \"../react/Admin\";\nimport type { GRState } from \"../core/types\";\n\n/**\n * Wraps a root layout so every route carries Guardrail's edit state and admin\n * chrome. Stays a Server Component: the provider below is the client boundary.\n */\nexport function withGuardrail<P extends object>(\n  LayoutComponent: React.ComponentType<P>,\n  config: GRConfig,\n) {\n  // Applied at module evaluation so the config is present as soon as anything\n  // imports the layout, and again per render because Next.js does not\n  // guarantee one shared module instance across its server contexts.\n  configureGuardrail(config);\n\n  return async function GuardrailLayout(props: P) {\n    configureGuardrail(config);\n\n    const cookieStore = await cookies();\n\n    // Verified against the auth provider, not inferred from a cookie. Loaded\n    // alongside the content preload: independent round trips, and the preload\n    // is shared with the page's own fields, so it costs them nothing extra.\n    const [viewer, content] = await Promise.all([\n      getCachedViewer(),\n      loadPreloadedContent(),\n    ]);\n\n    const auth = getAuth();\n\n    // \"false\" is an explicit, deliberate suppression (?edit=false while still\n    // signed in, to preview without chrome) and wins outright. Otherwise, a\n    // real session is enough on its own — an authenticated editor's chrome\n    // persists for as long as that session does, with no separate cookie\n    // timer to fall out of sync with it. \"true\" only matters for someone not\n    // yet authenticated: a short-lived grace window (see GR_EDIT_MODE_TTL_SECONDS)\n    // to actually reach the sign-in form, not a standing invitation — the\n    // previous design kept this cookie alive indefinitely once set, which\n    // meant a stray copy of it kept showing the sign-in bar to whoever's\n    // browser it was sitting in, for as long as that browser stayed open.\n    const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;\n    const isAuth = viewer !== null;\n    // Set by completeAuthRedirectAction the moment an invite/recovery link\n    // finishes — forces chrome on regardless of the edit-mode cookie, since\n    // the whole point is to show the set-password prompt right away, not\n    // require also having ?edit=true or an unsuppressed cookie.\n    const needsPassword = cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === \"true\";\n    const isEditMode =\n      needsPassword || (editCookie === \"false\" ? false : editCookie === \"true\" || isAuth);\n\n    const state: GRState = {\n      storage: getStorage() !== undefined,\n      auth: {\n        password: typeof auth.authenticate === \"function\",\n        ...(auth.signInUrl ? { signInUrl: auth.signInUrl } : {}),\n      },\n      isAuth,\n      isEditMode,\n      needsPassword,\n      siteId: await resolveSiteId(),\n      role: viewer?.role ?? null,\n      ...(viewer?.email ? { email: viewer.email } : {}),\n    };\n\n    return (\n      <GRailProvider state={state} content={content}>\n        <LayoutComponent {...props} />\n        <Suspense fallback={null}>\n          <GRailAdmin toolbarExtra={config.toolbarExtra} />\n        </Suspense>\n      </GRailProvider>\n    );\n  };\n}\n"],"mappings":"AA+EM,SACE,KADF;AA/EN,OAAO,SAAS,gBAAgB;AAChC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AAErC,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAOpB,SAAS,cACd,iBACA,QACA;AAIA,qBAAmB,MAAM;AAEzB,SAAO,eAAe,gBAAgB,OAAU;AAC9C,uBAAmB,MAAM;AAEzB,UAAM,cAAc,MAAM,QAAQ;AAKlC,UAAM,CAAC,QAAQ,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,IACvB,CAAC;AAED,UAAM,OAAO,QAAQ;AAYrB,UAAM,aAAa,YAAY,IAAI,WAAW,SAAS,GAAG;AAC1D,UAAM,SAAS,WAAW;AAK1B,UAAM,gBAAgB,YAAY,IAAI,WAAW,cAAc,GAAG,UAAU;AAC5E,UAAM,aACJ,kBAAkB,eAAe,UAAU,QAAQ,eAAe,UAAU;AAE9E,UAAM,QAAiB;AAAA,MACrB,SAAS,WAAW,MAAM;AAAA,MAC1B,MAAM;AAAA,QACJ,UAAU,OAAO,KAAK,iBAAiB;AAAA,QACvC,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,MAAM,cAAc;AAAA,MAC5B,MAAM,QAAQ,QAAQ;AAAA,MACtB,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IACjD;AAEA,WACE,qBAAC,iBAAc,OAAc,SAC3B;AAAA,0BAAC,mBAAiB,GAAG,OAAO;AAAA,MAC5B,oBAAC,YAAS,UAAU,MAClB,8BAAC,cAAW,cAAc,OAAO,cAAc,GACjD;AAAA,OACF;AAAA,EAEJ;AACF;","names":[]}
+{"version":3,"sources":["../../src/server/wrapper.tsx"],"sourcesContent":["import React, { Suspense } from \"react\";\nimport { cookies } from \"next/headers\";\nimport {\n  configureGuardrail,\n  getAuth,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { resolveEditMode } from \"./access\";\nimport { loadPreloadedContent } from \"./loader\";\nimport type { GRConfig } from \"../core/adapter-types\";\nimport { GRailProvider } from \"../react/Provider\";\nimport { GRailAdmin } from \"../react/Admin\";\nimport type { GRState } from \"../core/types\";\n\n/**\n * Wraps a root layout so every route carries Guardrail's edit state and admin\n * chrome. Stays a Server Component: the provider below is the client boundary.\n */\nexport function withGuardrail<P extends object>(\n  LayoutComponent: React.ComponentType<P>,\n  config: GRConfig,\n) {\n  // Applied at module evaluation so the config is present as soon as anything\n  // imports the layout, and again per render because Next.js does not\n  // guarantee one shared module instance across its server contexts.\n  configureGuardrail(config);\n\n  return async function GuardrailLayout(props: P) {\n    configureGuardrail(config);\n\n    const cookieStore = await cookies();\n\n    // Verified against the auth provider, not inferred from a cookie. Loaded\n    // alongside the content preload: independent round trips, and the preload\n    // is shared with the page's own fields, so it costs them nothing extra.\n    const [viewer, content] = await Promise.all([\n      getCachedViewer(),\n      loadPreloadedContent(),\n    ]);\n\n    const auth = getAuth();\n\n    // The rule for what counts as \"in edit mode\" lives in resolveEditMode —\n    // shared with canEdit() so the layout and the server helper can't disagree.\n    const isAuth = viewer !== null;\n    const { isEditMode, needsPassword } = resolveEditMode(viewer, cookieStore);\n    const role = viewer?.role ?? null;\n\n    const state: GRState = {\n      storage: getStorage() !== undefined,\n      auth: {\n        password: typeof auth.authenticate === \"function\",\n        ...(auth.signInUrl ? { signInUrl: auth.signInUrl } : {}),\n      },\n      isAuth,\n      isEditMode,\n      needsPassword,\n      siteId: await resolveSiteId(),\n      role,\n      canEdit: isEditMode && role !== null,\n      ...(viewer?.email ? { email: viewer.email } : {}),\n    };\n\n    return (\n      <GRailProvider state={state} content={content}>\n        <LayoutComponent {...props} />\n        <Suspense fallback={null}>\n          <GRailAdmin toolbarExtra={config.toolbarExtra} />\n        </Suspense>\n      </GRailProvider>\n    );\n  };\n}\n"],"mappings":"AAkEM,SACE,KADF;AAlEN,OAAO,SAAS,gBAAgB;AAChC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AAErC,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAOpB,SAAS,cACd,iBACA,QACA;AAIA,qBAAmB,MAAM;AAEzB,SAAO,eAAe,gBAAgB,OAAU;AAC9C,uBAAmB,MAAM;AAEzB,UAAM,cAAc,MAAM,QAAQ;AAKlC,UAAM,CAAC,QAAQ,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,IACvB,CAAC;AAED,UAAM,OAAO,QAAQ;AAIrB,UAAM,SAAS,WAAW;AAC1B,UAAM,EAAE,YAAY,cAAc,IAAI,gBAAgB,QAAQ,WAAW;AACzE,UAAM,OAAO,QAAQ,QAAQ;AAE7B,UAAM,QAAiB;AAAA,MACrB,SAAS,WAAW,MAAM;AAAA,MAC1B,MAAM;AAAA,QACJ,UAAU,OAAO,KAAK,iBAAiB;AAAA,QACvC,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ,MAAM,cAAc;AAAA,MAC5B;AAAA,MACA,SAAS,cAAc,SAAS;AAAA,MAChC,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IACjD;AAEA,WACE,qBAAC,iBAAc,OAAc,SAC3B;AAAA,0BAAC,mBAAiB,GAAG,OAAO;AAAA,MAC5B,oBAAC,YAAS,UAAU,MAClB,8BAAC,cAAW,cAAc,OAAO,cAAc,GACjD;AAAA,OACF;AAAA,EAEJ;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guard-rail/core",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Lightweight inline content editing for developer-owned Next.js sites.",
   "license": "ISC",
   "type": "module",