@guard-rail/core 0.7.1 → 0.9.0

package/dist/core/adapter-types.d.ts

@@ -76,18 +76,45 @@ interface GRAuthAdapter {
      */
     signInUrl?: string;
     /**
-     * Ask the provider to create an account for an invited address and contact
-     * them. Optional — Guardrail falls back to the onInvite callback when the
-     * provider cannot do it.
+     * Create the account and return a one-time link that lets the invitee choose
+     * a password, without sending anything — Guardrail hands it to the app's
+     * onInvite handler to email. Optional: an adapter that can't mint links
+     * leaves delivery entirely to onInvite, which then gets no `link`.
      *
      * Account creation stays the identity provider's job. Guardrail records who
      * is allowed to edit; it never owns credentials.
+     *
+     * `origin` is the site's own origin, so the link points back at the site
+     * (where AuthRedirectSync completes it) rather than at the provider — which
+     * is why no redirect allowlist is involved. `isNewUser` says whether this
+     * created an account or the address already had one. A new account's link
+     * lets them choose a password. An existing account's "link" is just the
+     * site's address, with no token: they already have a password, and an emailed
+     * link must not be a way to sign in.
      */
-    inviteUser?: (email: string, options?: {
-        redirectTo?: string;
+    createInviteLink?: (email: string, options: {
+        origin: string;
     }) => Promise<{
-        success: boolean;
-        error?: string;
+        success: true;
+        link: string;
+        isNewUser: boolean;
+    } | {
+        success: false;
+        error: string;
+    }>;
+    /**
+     * Mint a one-time "set a new password" link without sending anything;
+     * Guardrail hands it to onPasswordReset to email. Same shape and reasoning as
+     * createInviteLink. Without it, password resets can't be sent.
+     */
+    createPasswordResetLink?: (email: string, options: {
+        origin: string;
+    }) => Promise<{
+        success: true;
+        link: string;
+    } | {
+        success: false;
+        error: string;
     }>;
     /**
      * Return the current verified session, or null.
@@ -171,6 +198,16 @@ interface GRMembershipAdapter {
         success: boolean;
         error?: string;
     }>;
+    /**
+     * Whether this address is a member of the site — checked with no session,
+     * for the "forgot password" request that arrives before anyone is signed in.
+     * Optional because it needs privileged access to the membership store, which
+     * a normal anonymous session doesn't have; without it, Guardrail can't tell
+     * a member from anyone else and a reset goes to any address that asks, so an
+     * adapter that offers createPasswordResetLink should offer this too. Used
+     * only to decide whether to send, never to answer the requester.
+     */
+    emailHasAccess?: (siteId: string, email: string) => Promise<boolean>;
     /**
      * Bind a pending invitation to the signed-in user.
      *
@@ -247,6 +284,23 @@ interface GRInviteEvent {
     role: GRRole;
     siteId: string;
     invitedBy: string;
+    /**
+     * A one-time sign-in link for the invitee, present when the auth adapter can
+     * create one (see createInviteLink). Put it in the email. Absent for an
+     * adapter that can't, in which case delivering access is entirely the app's
+     * job.
+     */
+    link?: string;
+    /** Whether the invite created an account (true) or the address already had one. Set alongside `link`. */
+    isNewUser?: boolean;
+}
+interface GRPasswordResetEvent {
+    email: string;
+    siteId: string;
+    /** A one-time link that lets the person choose a new password. */
+    link: string;
+    /** "self" for someone who asked from the sign-in bar; otherwise the admin who sent it. */
+    requestedBy: string;
 }
 interface GRConfig {
     db: GRDBAdapter;
@@ -258,12 +312,26 @@ interface GRConfig {
     repeaters?: GRRepeaterAdapter;
     siteId: string | (() => string | Promise<string>);
     /**
-     * Called when an admin invites someone. Guardrail records the pending
-     * membership; delivering the invitation is the app's job, using whatever
-     * mail provider it already has. In-process by design — a library running
-     * inside the developer's server has no need for webhooks.
+     * How an invitation gets delivered. Guardrail records the pending membership
+     * and — when the auth adapter can (createInviteLink) — creates the account and
+     * a one-time link; this handler emails it, with whatever mail provider the app
+     * already has. `resendEmails()` is a ready-made one. In-process by design — a
+     * library running inside the developer's server has no need for webhooks.
+     *
+     * Required for invites to reach anyone: without it the admin is told the
+     * invite was saved but nothing sent it. Throwing reports the failure to the
+     * admin who sent the invite.
      */
     onInvite?: (event: GRInviteEvent) => void | Promise<void>;
+    /**
+     * Delivers a password-reset email — for "Forgot password?" on the sign-in
+     * bar, and for the reset an admin sends from the Team drawer. Needs an auth
+     * adapter that can mint the link (createPasswordResetLink); the event carries
+     * it. `resendEmails()` provides this too. Without it, resets can't be sent.
+     * Throwing is reported to the admin who sent it; a self-service request always
+     * looks successful to the requester, so a missing account can't be probed.
+     */
+    onPasswordReset?: (event: GRPasswordResetEvent) => void | Promise<void>;
     /**
      * Extra content rendered in the toolbar pill, next to Team and Log out.
      * Plain JSX, not a component reference or a structured item schema — the
@@ -285,4 +353,4 @@ interface GRConfig {
     prefetch?: false | GRPrefetch;
 }
 
-export type { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget };
+export type { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget };

package/dist/core/config.d.ts

@@ -28,6 +28,7 @@ declare function getPrefetch(): {
     limit: number;
 } | null;
 declare function getInviteHandler(): GRConfig["onInvite"];
+declare function getPasswordResetHandler(): GRConfig["onPasswordReset"];
 declare function resolveSiteId(): Promise<string>;
 
-export { DEFAULT_PREFETCH_LIMIT, configureGuardrail, getAuth, getDB, getInviteHandler, getMembers, getPrefetch, getRepeaters, getStorage, resolveSiteId };
+export { DEFAULT_PREFETCH_LIMIT, configureGuardrail, getAuth, getDB, getInviteHandler, getMembers, getPasswordResetHandler, getPrefetch, getRepeaters, getStorage, resolveSiteId };

package/dist/core/config.js

@@ -38,6 +38,9 @@ function getPrefetch() {
 function getInviteHandler() {
   return _config?.onInvite;
 }
+function getPasswordResetHandler() {
+  return _config?.onPasswordReset;
+}
 async function resolveSiteId() {
   const sid = _config?.siteId ?? "default";
   return typeof sid === "function" ? await sid() : sid || "default";
@@ -49,6 +52,7 @@ export {
   getDB,
   getInviteHandler,
   getMembers,
+  getPasswordResetHandler,
   getPrefetch,
   getRepeaters,
   getStorage,

package/dist/core/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/config.ts"],"sourcesContent":["import type {\n  GRConfig,\n  GRAuthAdapter,\n  GRDBAdapter,\n  GRMembershipAdapter,\n  GRRepeaterAdapter,\n  GRStorageAdapter,\n} from \"./adapter-types\";\n\nlet _config: GRConfig | null = null;\n\n/**\n * Registers the adapters Guardrail should use.\n *\n * Idempotent, and re-applied on every render by withGuardrail: Next.js does not\n * guarantee one shared module instance across the SSR graph, the server-action\n * graph, and the workers used for static generation, so config registered once\n * at startup is simply absent in some of them.\n *\n * Core has no knowledge of any particular backend — there is no default and no\n * fallback. An app names its adapters explicitly or Guardrail refuses to run.\n */\nexport function configureGuardrail(config: GRConfig): void {\n  _config = config;\n}\n\nfunction required<K extends keyof GRConfig>(key: K): GRConfig[K] {\n  const value = _config?.[key];\n  if (!value) {\n    throw new Error(\n      `Guardrail: no ${String(key)} adapter configured. Pass one to ` +\n        `withGuardrail(Layout, { db, auth, members }).`,\n    );\n  }\n  return value;\n}\n\nexport function getDB(): GRDBAdapter {\n  return required(\"db\") as GRDBAdapter;\n}\n\nexport function getAuth(): GRAuthAdapter {\n  return required(\"auth\") as GRAuthAdapter;\n}\n\nexport function getMembers(): GRMembershipAdapter {\n  return required(\"members\") as GRMembershipAdapter;\n}\n\n/** Optional — sites without editable images need no storage. */\nexport function getStorage(): GRStorageAdapter | undefined {\n  return _config?.storage;\n}\n\n/** Throws with a clear message if no page on this site uses <GRepeater>. */\nexport function getRepeaters(): GRRepeaterAdapter {\n  return required(\"repeaters\") as GRRepeaterAdapter;\n}\n\nexport const DEFAULT_PREFETCH_LIMIT = 500;\n\n/** Normalized preload settings, or null when preloading is off. */\nexport function getPrefetch(): { prefix?: string[]; limit: number } | null {\n  const p = _config?.prefetch;\n  if (p === false) return null;\n  return {\n    ...(p?.prefix?.length ? { prefix: p.prefix } : {}),\n    limit: p?.limit ?? DEFAULT_PREFETCH_LIMIT,\n  };\n}\n\nexport function getInviteHandler(): GRConfig[\"onInvite\"] {\n  return _config?.onInvite;\n}\n\nexport async function resolveSiteId(): Promise<string> {\n  const sid = _config?.siteId ?? \"default\";\n  return typeof sid === \"function\" ? await sid() : sid || \"default\";\n}\n"],"mappings":"AASA,IAAI,UAA2B;AAaxB,SAAS,mBAAmB,QAAwB;AACzD,YAAU;AACZ;AAEA,SAAS,SAAmC,KAAqB;AAC/D,QAAM,QAAQ,UAAU,GAAG;AAC3B,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,iBAAiB,OAAO,GAAG,CAAC;AAAA,IAE9B;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,QAAqB;AACnC,SAAO,SAAS,IAAI;AACtB;AAEO,SAAS,UAAyB;AACvC,SAAO,SAAS,MAAM;AACxB;AAEO,SAAS,aAAkC;AAChD,SAAO,SAAS,SAAS;AAC3B;AAGO,SAAS,aAA2C;AACzD,SAAO,SAAS;AAClB;AAGO,SAAS,eAAkC;AAChD,SAAO,SAAS,WAAW;AAC7B;AAEO,MAAM,yBAAyB;AAG/B,SAAS,cAA2D;AACzE,QAAM,IAAI,SAAS;AACnB,MAAI,MAAM,MAAO,QAAO;AACxB,SAAO;AAAA,IACL,GAAI,GAAG,QAAQ,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,IAChD,OAAO,GAAG,SAAS;AAAA,EACrB;AACF;AAEO,SAAS,mBAAyC;AACvD,SAAO,SAAS;AAClB;AAEA,eAAsB,gBAAiC;AACrD,QAAM,MAAM,SAAS,UAAU;AAC/B,SAAO,OAAO,QAAQ,aAAa,MAAM,IAAI,IAAI,OAAO;AAC1D;","names":[]}
+{"version":3,"sources":["../../src/core/config.ts"],"sourcesContent":["import type {\n  GRConfig,\n  GRAuthAdapter,\n  GRDBAdapter,\n  GRMembershipAdapter,\n  GRRepeaterAdapter,\n  GRStorageAdapter,\n} from \"./adapter-types\";\n\nlet _config: GRConfig | null = null;\n\n/**\n * Registers the adapters Guardrail should use.\n *\n * Idempotent, and re-applied on every render by withGuardrail: Next.js does not\n * guarantee one shared module instance across the SSR graph, the server-action\n * graph, and the workers used for static generation, so config registered once\n * at startup is simply absent in some of them.\n *\n * Core has no knowledge of any particular backend — there is no default and no\n * fallback. An app names its adapters explicitly or Guardrail refuses to run.\n */\nexport function configureGuardrail(config: GRConfig): void {\n  _config = config;\n}\n\nfunction required<K extends keyof GRConfig>(key: K): GRConfig[K] {\n  const value = _config?.[key];\n  if (!value) {\n    throw new Error(\n      `Guardrail: no ${String(key)} adapter configured. Pass one to ` +\n        `withGuardrail(Layout, { db, auth, members }).`,\n    );\n  }\n  return value;\n}\n\nexport function getDB(): GRDBAdapter {\n  return required(\"db\") as GRDBAdapter;\n}\n\nexport function getAuth(): GRAuthAdapter {\n  return required(\"auth\") as GRAuthAdapter;\n}\n\nexport function getMembers(): GRMembershipAdapter {\n  return required(\"members\") as GRMembershipAdapter;\n}\n\n/** Optional — sites without editable images need no storage. */\nexport function getStorage(): GRStorageAdapter | undefined {\n  return _config?.storage;\n}\n\n/** Throws with a clear message if no page on this site uses <GRepeater>. */\nexport function getRepeaters(): GRRepeaterAdapter {\n  return required(\"repeaters\") as GRRepeaterAdapter;\n}\n\nexport const DEFAULT_PREFETCH_LIMIT = 500;\n\n/** Normalized preload settings, or null when preloading is off. */\nexport function getPrefetch(): { prefix?: string[]; limit: number } | null {\n  const p = _config?.prefetch;\n  if (p === false) return null;\n  return {\n    ...(p?.prefix?.length ? { prefix: p.prefix } : {}),\n    limit: p?.limit ?? DEFAULT_PREFETCH_LIMIT,\n  };\n}\n\nexport function getInviteHandler(): GRConfig[\"onInvite\"] {\n  return _config?.onInvite;\n}\n\nexport function getPasswordResetHandler(): GRConfig[\"onPasswordReset\"] {\n  return _config?.onPasswordReset;\n}\n\nexport async function resolveSiteId(): Promise<string> {\n  const sid = _config?.siteId ?? \"default\";\n  return typeof sid === \"function\" ? await sid() : sid || \"default\";\n}\n"],"mappings":"AASA,IAAI,UAA2B;AAaxB,SAAS,mBAAmB,QAAwB;AACzD,YAAU;AACZ;AAEA,SAAS,SAAmC,KAAqB;AAC/D,QAAM,QAAQ,UAAU,GAAG;AAC3B,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,iBAAiB,OAAO,GAAG,CAAC;AAAA,IAE9B;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,QAAqB;AACnC,SAAO,SAAS,IAAI;AACtB;AAEO,SAAS,UAAyB;AACvC,SAAO,SAAS,MAAM;AACxB;AAEO,SAAS,aAAkC;AAChD,SAAO,SAAS,SAAS;AAC3B;AAGO,SAAS,aAA2C;AACzD,SAAO,SAAS;AAClB;AAGO,SAAS,eAAkC;AAChD,SAAO,SAAS,WAAW;AAC7B;AAEO,MAAM,yBAAyB;AAG/B,SAAS,cAA2D;AACzE,QAAM,IAAI,SAAS;AACnB,MAAI,MAAM,MAAO,QAAO;AACxB,SAAO;AAAA,IACL,GAAI,GAAG,QAAQ,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,IAChD,OAAO,GAAG,SAAS;AAAA,EACrB;AACF;AAEO,SAAS,mBAAyC;AACvD,SAAO,SAAS;AAClB;AAEO,SAAS,0BAAuD;AACrE,SAAO,SAAS;AAClB;AAEA,eAAsB,gBAAiC;AACrD,QAAM,MAAM,SAAS,UAAU;AAC/B,SAAO,OAAO,QAAQ,aAAa,MAAM,IAAI,IAAI,OAAO;AAC1D;","names":[]}

package/dist/core/defs.d.ts

@@ -24,7 +24,17 @@ declare const GR_COOKIES: {
      * they explicitly skip.
      */
     readonly NEEDS_PASSWORD: "gr_needs_password";
+    /**
+     * Set server-side when an emailed link fails to complete — expired, already
+     * used, or malformed — so the next render can say so instead of leaving the
+     * person on a plain page wondering why nothing happened. Holds a short code
+     * ("expired" | "failed"), never the provider's own message. Short-lived and
+     * cleared when the message is dismissed.
+     */
+    readonly AUTH_ERROR: "gr_auth_error";
 };
+/** How long a "that link didn't work" message waits to be seen. */
+declare const GR_AUTH_ERROR_TTL_SECONDS: number;
 /**
  * How long the edit-mode cookie's "true"/"false" values last before
  * reverting to the session-derived default. Short on purpose: it only ever
@@ -72,4 +82,4 @@ declare const GR_TABLE = "gr_content";
 declare const GR_MEMBERS_TABLE = "gr_members";
 declare const GR_REPEATER_TABLE = "gr_repeater_items";
 
-export { GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS, GR_EDIT_MODE_TTL_SECONDS, GR_MEMBERS_TABLE, GR_NEEDS_PASSWORD_TTL_SECONDS, GR_REPEATER_TABLE, GR_SCHEMA, GR_TABLE };
+export { GR_AUTH_ERROR_TTL_SECONDS, GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS, GR_EDIT_MODE_TTL_SECONDS, GR_MEMBERS_TABLE, GR_NEEDS_PASSWORD_TTL_SECONDS, GR_REPEATER_TABLE, GR_SCHEMA, GR_TABLE };

package/dist/core/defs.js

@@ -23,8 +23,17 @@ const GR_COOKIES = {
    * instead of showing the normal toolbar. Cleared once they do, or once
    * they explicitly skip.
    */
-  NEEDS_PASSWORD: "gr_needs_password"
+  NEEDS_PASSWORD: "gr_needs_password",
+  /**
+   * Set server-side when an emailed link fails to complete — expired, already
+   * used, or malformed — so the next render can say so instead of leaving the
+   * person on a plain page wondering why nothing happened. Holds a short code
+   * ("expired" | "failed"), never the provider's own message. Short-lived and
+   * cleared when the message is dismissed.
+   */
+  AUTH_ERROR: "gr_auth_error"
 };
+const GR_AUTH_ERROR_TTL_SECONDS = 2 * 60;
 const GR_EDIT_MODE_TTL_SECONDS = 10 * 60;
 const GR_EDIT_MODE_OFF_TTL_SECONDS = 400 * 24 * 60 * 60;
 const GR_NEEDS_PASSWORD_TTL_SECONDS = 30 * 60;
@@ -33,6 +42,7 @@ const GR_TABLE = "gr_content";
 const GR_MEMBERS_TABLE = "gr_members";
 const GR_REPEATER_TABLE = "gr_repeater_items";
 export {
+  GR_AUTH_ERROR_TTL_SECONDS,
   GR_COOKIES,
   GR_EDIT_MODE_OFF_TTL_SECONDS,
   GR_EDIT_MODE_TTL_SECONDS,

package/dist/core/defs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/defs.ts"],"sourcesContent":["export const GR_COOKIES = {\n  /**\n   * Signals intent to edit. Carries no authority on its own — every write\n   * still goes through a real, server-verified role check, independent of\n   * this — but it does decide whether the admin chrome (the sign-in bar, or\n   * the toolbar) renders at all, so it is not harmless either: a stale copy\n   * of it is a real, if low-stakes, exposure (\"there's a CMS here\") to\n   * whoever's browser it's sitting in next, not just its original visitor.\n   *\n   * Values: \"true\" (show chrome — the short-lived grace window below, for\n   * someone not yet authenticated to reach the sign-in form), \"false\"\n   * (explicitly suppressed, e.g. ?edit=false previewing without chrome while\n   * still signed in), or absent. Absent defers entirely to whether a real\n   * session exists (see withGuardrail) — an authenticated editor's chrome\n   * persists for as long as their actual session does, with no separate\n   * timer of its own to fall out of sync with it.\n   */\n  EDIT_MODE: \"gr_edit_mode\",\n  /**\n   * Set server-side the moment a redirect-carried session (an invite or\n   * password-recovery link) completes, so the next render — which has no\n   * other way to know that just happened — prompts to set a password\n   * instead of showing the normal toolbar. Cleared once they do, or once\n   * they explicitly skip.\n   */\n  NEEDS_PASSWORD: \"gr_needs_password\",\n} as const;\n\n/**\n * How long the edit-mode cookie's \"true\"/\"false\" values last before\n * reverting to the session-derived default. Short on purpose: it only ever\n * needs to outlive the handful of clicks between landing on ?edit=true and\n * actually typing a password (or, for ?edit=false, a quick chrome-free\n * preview) — not a whole working session, which persists through real auth\n * instead. Bounds how long a stray copy of this cookie can show anything to\n * whoever's browser it's left in, self-healing without needing an explicit\n * logout.\n */\nexport const GR_EDIT_MODE_TTL_SECONDS = 10 * 60;\n\n/**\n * How long an explicit \"off\" (the toolbar's exit button, ?edit=false, or the\n * sign-in bar's dismiss) is remembered. Long, unlike \"true\" above, because the\n * two fail differently: a stale \"true\" can put a sign-in bar in front of\n * someone who never asked for it, so it's kept short — a stale \"false\" only\n * ever hides chrome, so there's nothing to bound. It has to last as long as\n * the session it sits on top of: an editor who exited stays exited (instead of\n * the overlay reappearing by itself once a short timer lapsed) until they ask\n * for edit mode again with ?edit=true. Matches the Supabase session cookie's\n * 400 days.\n */\nexport const GR_EDIT_MODE_OFF_TTL_SECONDS = 400 * 24 * 60 * 60;\n\n/**\n * How long the set-a-password prompt stays up after an invite/recovery link\n * completes. Longer than the edit-mode window above — picking a password\n * takes more than one click — but still bounded, rather than nagging\n * indefinitely if it's skipped and the cookie is somehow never cleared.\n */\nexport const GR_NEEDS_PASSWORD_TTL_SECONDS = 30 * 60;\n\n/**\n * Dedicated Postgres schema, not `public`. A name prefix alone only guards\n * against accidental collisions; it does nothing against a `supabase db\n * reset`, a broad `DROP ... CASCADE`, or a migration tool that diffs and\n * \"reconciles\" everything in `public` as if it owns that namespace. A\n * separate schema keeps Guardrail's tables outside that blast radius —\n * the same reason auth.* and storage.* are their own schemas, not public.*.\n *\n * Requires \"guardrail\" to be added under Settings > API > Exposed schemas in\n * the Supabase dashboard — PostgREST only serves schemas on that list, and no\n * migration can add itself to it.\n */\nexport const GR_SCHEMA = \"guardrail\";\n\nexport const GR_TABLE = \"gr_content\";\nexport const GR_MEMBERS_TABLE = \"gr_members\";\nexport const GR_REPEATER_TABLE = \"gr_repeater_items\";\n"],"mappings":"AAAO,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBxB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQX,gBAAgB;AAClB;AAYO,MAAM,2BAA2B,KAAK;AAatC,MAAM,+BAA+B,MAAM,KAAK,KAAK;AAQrD,MAAM,gCAAgC,KAAK;AAc3C,MAAM,YAAY;AAElB,MAAM,WAAW;AACjB,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;","names":[]}
+{"version":3,"sources":["../../src/core/defs.ts"],"sourcesContent":["export const GR_COOKIES = {\n  /**\n   * Signals intent to edit. Carries no authority on its own — every write\n   * still goes through a real, server-verified role check, independent of\n   * this — but it does decide whether the admin chrome (the sign-in bar, or\n   * the toolbar) renders at all, so it is not harmless either: a stale copy\n   * of it is a real, if low-stakes, exposure (\"there's a CMS here\") to\n   * whoever's browser it's sitting in next, not just its original visitor.\n   *\n   * Values: \"true\" (show chrome — the short-lived grace window below, for\n   * someone not yet authenticated to reach the sign-in form), \"false\"\n   * (explicitly suppressed, e.g. ?edit=false previewing without chrome while\n   * still signed in), or absent. Absent defers entirely to whether a real\n   * session exists (see withGuardrail) — an authenticated editor's chrome\n   * persists for as long as their actual session does, with no separate\n   * timer of its own to fall out of sync with it.\n   */\n  EDIT_MODE: \"gr_edit_mode\",\n  /**\n   * Set server-side the moment a redirect-carried session (an invite or\n   * password-recovery link) completes, so the next render — which has no\n   * other way to know that just happened — prompts to set a password\n   * instead of showing the normal toolbar. Cleared once they do, or once\n   * they explicitly skip.\n   */\n  NEEDS_PASSWORD: \"gr_needs_password\",\n  /**\n   * Set server-side when an emailed link fails to complete — expired, already\n   * used, or malformed — so the next render can say so instead of leaving the\n   * person on a plain page wondering why nothing happened. Holds a short code\n   * (\"expired\" | \"failed\"), never the provider's own message. Short-lived and\n   * cleared when the message is dismissed.\n   */\n  AUTH_ERROR: \"gr_auth_error\",\n} as const;\n\n/** How long a \"that link didn't work\" message waits to be seen. */\nexport const GR_AUTH_ERROR_TTL_SECONDS = 2 * 60;\n\n/**\n * How long the edit-mode cookie's \"true\"/\"false\" values last before\n * reverting to the session-derived default. Short on purpose: it only ever\n * needs to outlive the handful of clicks between landing on ?edit=true and\n * actually typing a password (or, for ?edit=false, a quick chrome-free\n * preview) — not a whole working session, which persists through real auth\n * instead. Bounds how long a stray copy of this cookie can show anything to\n * whoever's browser it's left in, self-healing without needing an explicit\n * logout.\n */\nexport const GR_EDIT_MODE_TTL_SECONDS = 10 * 60;\n\n/**\n * How long an explicit \"off\" (the toolbar's exit button, ?edit=false, or the\n * sign-in bar's dismiss) is remembered. Long, unlike \"true\" above, because the\n * two fail differently: a stale \"true\" can put a sign-in bar in front of\n * someone who never asked for it, so it's kept short — a stale \"false\" only\n * ever hides chrome, so there's nothing to bound. It has to last as long as\n * the session it sits on top of: an editor who exited stays exited (instead of\n * the overlay reappearing by itself once a short timer lapsed) until they ask\n * for edit mode again with ?edit=true. Matches the Supabase session cookie's\n * 400 days.\n */\nexport const GR_EDIT_MODE_OFF_TTL_SECONDS = 400 * 24 * 60 * 60;\n\n/**\n * How long the set-a-password prompt stays up after an invite/recovery link\n * completes. Longer than the edit-mode window above — picking a password\n * takes more than one click — but still bounded, rather than nagging\n * indefinitely if it's skipped and the cookie is somehow never cleared.\n */\nexport const GR_NEEDS_PASSWORD_TTL_SECONDS = 30 * 60;\n\n/**\n * Dedicated Postgres schema, not `public`. A name prefix alone only guards\n * against accidental collisions; it does nothing against a `supabase db\n * reset`, a broad `DROP ... CASCADE`, or a migration tool that diffs and\n * \"reconciles\" everything in `public` as if it owns that namespace. A\n * separate schema keeps Guardrail's tables outside that blast radius —\n * the same reason auth.* and storage.* are their own schemas, not public.*.\n *\n * Requires \"guardrail\" to be added under Settings > API > Exposed schemas in\n * the Supabase dashboard — PostgREST only serves schemas on that list, and no\n * migration can add itself to it.\n */\nexport const GR_SCHEMA = \"guardrail\";\n\nexport const GR_TABLE = \"gr_content\";\nexport const GR_MEMBERS_TABLE = \"gr_members\";\nexport const GR_REPEATER_TABLE = \"gr_repeater_items\";\n"],"mappings":"AAAO,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBxB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQX,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhB,YAAY;AACd;AAGO,MAAM,4BAA4B,IAAI;AAYtC,MAAM,2BAA2B,KAAK;AAatC,MAAM,+BAA+B,MAAM,KAAK,KAAK;AAQrD,MAAM,gCAAgC,KAAK;AAc3C,MAAM,YAAY;AAElB,MAAM,WAAW;AACjB,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;","names":[]}

package/dist/core/types.d.ts

@@ -116,6 +116,12 @@ interface GRState {
     /** A redirect-carried session (an invite or recovery link) just completed
      * and has no password yet — see completeAuthRedirect. */
     needsPassword: boolean;
+    /**
+     * An emailed link just failed to complete — see GR_COOKIES.AUTH_ERROR. Set
+     * only for the render right after it happens, so the chrome can explain it
+     * and offer a fresh link.
+     */
+    authError?: "expired" | "failed";
     siteId: string;
     /** Null when the signed-in user holds no role on this site. */
     role: GRRole | null;

package/dist/email/resend.d.ts

@@ -0,0 +1,80 @@
+import { GRInviteEvent, GRPasswordResetEvent } from '../core/adapter-types.js';
+import 'react';
+import '../core/types.js';
+
+/** What gets sent: the pieces of one email. */
+interface ResendInviteContent {
+    subject: string;
+    html: string;
+    /** Plain-text alternative. Worth providing — some clients and spam filters prefer it. */
+    text?: string;
+}
+/** What a custom invite template is given: the invite, plus the link and name to put in it. */
+type ResendInviteTemplateEvent = GRInviteEvent & {
+    link: string;
+    siteName: string;
+};
+/** What a custom password-reset template is given. */
+type ResendResetTemplateEvent = GRPasswordResetEvent & {
+    siteName: string;
+};
+interface ResendInviteOptions {
+    /**
+     * "Name <hello@yourdomain.com>". The domain has to be verified in Resend, or
+     * Resend rejects the send.
+     */
+    from: string;
+    /** Resend API key. Defaults to `process.env.RESEND_API_KEY`, read when an email is sent. */
+    apiKey?: string;
+    /** Named in the default emails. Defaults to the site id. */
+    siteName?: string;
+    /**
+     * Replaces the default invite email entirely — your own subject, markup, brand.
+     * Called for both a brand-new account (`isNewUser` true: the link lets them
+     * choose a password) and an existing one (`isNewUser` false: the link just
+     * opens the site, where they sign in with the password they already have).
+     */
+    render?: (event: ResendInviteTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;
+    /** Override the endpoint, e.g. for a proxy or a test server. */
+    apiUrl?: string;
+}
+interface ResendEmailOptions extends ResendInviteOptions {
+    /** Replaces the default password-reset email. */
+    renderReset?: (event: ResendResetTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;
+}
+/**
+ * An `onInvite` handler that emails the invitee through Resend.
+ *
+ *   withGuardrail(Layout, {
+ *     ...supabaseAdapters({ url, anonKey, serviceRoleKey }),
+ *     onInvite: resendInvite({ from: "Acme <hello@acme.com>", siteName: "Acme" }),
+ *   });
+ *
+ * Needs an auth adapter that can create links (the Supabase adapter can once
+ * it's given a serviceRoleKey); without a link there is nothing to send, and it
+ * throws a message saying so. Throwing is how failures reach the admin who
+ * clicked Invite — Resend rejecting the sender domain, say.
+ *
+ * To send password-reset emails the same way, use resendEmails() instead, which
+ * supplies both handlers.
+ *
+ * Calls Resend's HTTP API directly, so there is no SDK to install. To send
+ * through anything else, write your own onInvite — the event carries the same
+ * `link`.
+ */
+declare function resendInvite(options: ResendInviteOptions): (event: GRInviteEvent) => Promise<void>;
+/**
+ * Both email handlers, backed by Resend: spread it into withGuardrail() and
+ * invites *and* password resets go out through your own domain.
+ *
+ *   withGuardrail(Layout, {
+ *     ...supabaseAdapters({ url, anonKey, serviceRoleKey }),
+ *     ...resendEmails({ from: "Acme <hello@acme.com>", siteName: "Acme" }),
+ *   });
+ */
+declare function resendEmails(options: ResendEmailOptions): {
+    onInvite: (event: GRInviteEvent) => Promise<void>;
+    onPasswordReset: (event: GRPasswordResetEvent) => Promise<void>;
+};
+
+export { type ResendEmailOptions, type ResendInviteContent, type ResendInviteOptions, type ResendInviteTemplateEvent, type ResendResetTemplateEvent, resendEmails, resendInvite };

package/dist/email/resend.js

@@ -0,0 +1,118 @@
+const RESEND_URL = "https://api.resend.com/emails";
+async function send(options, to, content) {
+  const apiKey = options.apiKey ?? process.env.RESEND_API_KEY;
+  if (!apiKey) throw new Error("RESEND_API_KEY is not set.");
+  const res = await fetch(options.apiUrl ?? RESEND_URL, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      from: options.from,
+      to: [to],
+      subject: content.subject,
+      html: content.html,
+      ...content.text ? { text: content.text } : {}
+    })
+  });
+  if (!res.ok) {
+    const detail = await res.json().then(
+      (body) => body?.message,
+      () => void 0
+    );
+    throw new Error(`Resend rejected the email (${res.status})${detail ? `: ${detail}` : "."}`);
+  }
+}
+async function sendInvite(options, event) {
+  if (!event.link) {
+    throw new Error(
+      "resendInvite needs a sign-in link, but the auth adapter didn't provide one \u2014 pass serviceRoleKey to supabaseAdapters() so it can create them."
+    );
+  }
+  const templateEvent = {
+    ...event,
+    link: event.link,
+    siteName: options.siteName ?? event.siteId
+  };
+  await send(options, event.email, await (options.render ?? defaultInviteEmail)(templateEvent));
+}
+function resendInvite(options) {
+  return (event) => sendInvite(options, event);
+}
+function resendEmails(options) {
+  return {
+    onInvite: (event) => sendInvite(options, event),
+    onPasswordReset: async (event) => {
+      const templateEvent = {
+        ...event,
+        siteName: options.siteName ?? event.siteId
+      };
+      await send(options, event.email, await (options.renderReset ?? defaultResetEmail)(templateEvent));
+    }
+  };
+}
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function layout(parts) {
+  const html = `<!doctype html>
+<html>
+  <body style="margin:0;padding:24px;background:#f6f6f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;color:#111;">
+    <div style="max-width:480px;margin:0 auto;background:#fff;border-radius:8px;padding:32px;">
+      <h1 style="margin:0 0 12px;font-size:20px;">${escapeHtml(parts.subject)}</h1>
+      <p style="margin:0 0 24px;line-height:1.5;">${escapeHtml(parts.intro)}</p>
+      <p style="margin:0 0 24px;">
+        <a href="${escapeHtml(parts.link)}" style="display:inline-block;background:#111;color:#fff;text-decoration:none;padding:12px 20px;border-radius:6px;font-weight:600;">${escapeHtml(parts.action)}</a>
+      </p>
+      <p style="margin:0;font-size:13px;line-height:1.5;color:#666;">${escapeHtml(parts.footnote)}</p>
+    </div>
+  </body>
+</html>`;
+  const text = `${parts.subject}
+
+${parts.intro}
+
+${parts.action}: ${parts.link}
+
+${parts.footnote}
+`;
+  return { subject: parts.subject, html, text };
+}
+function inviteEmail(event) {
+  const site = event.siteName;
+  const who = event.invitedBy.includes("@") ? event.invitedBy : "An admin";
+  if (event.isNewUser === false) {
+    return layout({
+      subject: `You've been added to ${site}`,
+      intro: `${who} added you to ${site} as an ${event.role}. You already have an account, so sign in with the password you already use.`,
+      action: `Open ${site}`,
+      link: event.link,
+      footnote: `Forgot your password? Choose "Forgot password?" on the sign-in bar and we'll email you a link to choose a new one.`
+    });
+  }
+  return layout({
+    subject: `You're invited to edit ${site}`,
+    intro: `${who} invited you to edit ${site} as an ${event.role}. Choose a password to finish setting up your account.`,
+    action: "Set your password",
+    link: event.link,
+    footnote: "This link works once and expires, so open it on the device you'll use. After you set a password, that's how you'll sign in."
+  });
+}
+const defaultInviteEmail = inviteEmail;
+function defaultResetEmail(event) {
+  const site = event.siteName;
+  const intro = event.requestedBy === "self" ? `You asked to reset your password for ${site}. Use the button below to choose a new one.` : `An admin of ${site} sent you a link to choose a new password.`;
+  return layout({
+    subject: `Reset your password for ${site}`,
+    intro,
+    action: "Choose a new password",
+    link: event.link,
+    footnote: "This link works once and expires. If you weren't expecting this, you can ignore the email and your password won't change."
+  });
+}
+export {
+  resendEmails,
+  resendInvite
+};
+//# sourceMappingURL=resend.js.map

package/dist/email/resend.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/email/resend.ts"],"sourcesContent":["import type { GRInviteEvent, GRPasswordResetEvent } from \"../core/adapter-types\";\n\n/** What gets sent: the pieces of one email. */\nexport interface ResendInviteContent {\n  subject: string;\n  html: string;\n  /** Plain-text alternative. Worth providing — some clients and spam filters prefer it. */\n  text?: string;\n}\n\n/** What a custom invite template is given: the invite, plus the link and name to put in it. */\nexport type ResendInviteTemplateEvent = GRInviteEvent & {\n  link: string;\n  siteName: string;\n};\n\n/** What a custom password-reset template is given. */\nexport type ResendResetTemplateEvent = GRPasswordResetEvent & {\n  siteName: string;\n};\n\nexport interface ResendInviteOptions {\n  /**\n   * \"Name <hello@yourdomain.com>\". The domain has to be verified in Resend, or\n   * Resend rejects the send.\n   */\n  from: string;\n  /** Resend API key. Defaults to `process.env.RESEND_API_KEY`, read when an email is sent. */\n  apiKey?: string;\n  /** Named in the default emails. Defaults to the site id. */\n  siteName?: string;\n  /**\n   * Replaces the default invite email entirely — your own subject, markup, brand.\n   * Called for both a brand-new account (`isNewUser` true: the link lets them\n   * choose a password) and an existing one (`isNewUser` false: the link just\n   * opens the site, where they sign in with the password they already have).\n   */\n  render?: (event: ResendInviteTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;\n  /** Override the endpoint, e.g. for a proxy or a test server. */\n  apiUrl?: string;\n}\n\nexport interface ResendEmailOptions extends ResendInviteOptions {\n  /** Replaces the default password-reset email. */\n  renderReset?: (event: ResendResetTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;\n}\n\nconst RESEND_URL = \"https://api.resend.com/emails\";\n\nasync function send(\n  options: ResendInviteOptions,\n  to: string,\n  content: ResendInviteContent,\n): Promise<void> {\n  const apiKey = options.apiKey ?? process.env.RESEND_API_KEY;\n  if (!apiKey) throw new Error(\"RESEND_API_KEY is not set.\");\n\n  const res = await fetch(options.apiUrl ?? RESEND_URL, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      from: options.from,\n      to: [to],\n      subject: content.subject,\n      html: content.html,\n      ...(content.text ? { text: content.text } : {}),\n    }),\n  });\n\n  if (!res.ok) {\n    const detail = await res.json().then(\n      (body: { message?: string }) => body?.message,\n      () => undefined,\n    );\n    throw new Error(`Resend rejected the email (${res.status})${detail ? `: ${detail}` : \".\"}`);\n  }\n}\n\nasync function sendInvite(options: ResendInviteOptions, event: GRInviteEvent): Promise<void> {\n  if (!event.link) {\n    throw new Error(\n      \"resendInvite needs a sign-in link, but the auth adapter didn't provide one — \" +\n        \"pass serviceRoleKey to supabaseAdapters() so it can create them.\",\n    );\n  }\n  const templateEvent: ResendInviteTemplateEvent = {\n    ...event,\n    link: event.link,\n    siteName: options.siteName ?? event.siteId,\n  };\n  await send(options, event.email, await (options.render ?? defaultInviteEmail)(templateEvent));\n}\n\n/**\n * An `onInvite` handler that emails the invitee through Resend.\n *\n *   withGuardrail(Layout, {\n *     ...supabaseAdapters({ url, anonKey, serviceRoleKey }),\n *     onInvite: resendInvite({ from: \"Acme <hello@acme.com>\", siteName: \"Acme\" }),\n *   });\n *\n * Needs an auth adapter that can create links (the Supabase adapter can once\n * it's given a serviceRoleKey); without a link there is nothing to send, and it\n * throws a message saying so. Throwing is how failures reach the admin who\n * clicked Invite — Resend rejecting the sender domain, say.\n *\n * To send password-reset emails the same way, use resendEmails() instead, which\n * supplies both handlers.\n *\n * Calls Resend's HTTP API directly, so there is no SDK to install. To send\n * through anything else, write your own onInvite — the event carries the same\n * `link`.\n */\nexport function resendInvite(options: ResendInviteOptions) {\n  return (event: GRInviteEvent): Promise<void> => sendInvite(options, event);\n}\n\n/**\n * Both email handlers, backed by Resend: spread it into withGuardrail() and\n * invites *and* password resets go out through your own domain.\n *\n *   withGuardrail(Layout, {\n *     ...supabaseAdapters({ url, anonKey, serviceRoleKey }),\n *     ...resendEmails({ from: \"Acme <hello@acme.com>\", siteName: \"Acme\" }),\n *   });\n */\nexport function resendEmails(options: ResendEmailOptions) {\n  return {\n    onInvite: (event: GRInviteEvent): Promise<void> => sendInvite(options, event),\n    onPasswordReset: async (event: GRPasswordResetEvent): Promise<void> => {\n      const templateEvent: ResendResetTemplateEvent = {\n        ...event,\n        siteName: options.siteName ?? event.siteId,\n      };\n      await send(options, event.email, await (options.renderReset ?? defaultResetEmail)(templateEvent));\n    },\n  };\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * One plain, readable-everywhere email: a heading, a sentence, one button, a\n * footnote. Interpolated values are escaped — the site name and inviter come\n * from config and from a person, and neither belongs in markup unescaped.\n */\nfunction layout(parts: {\n  subject: string;\n  intro: string;\n  action: string;\n  link: string;\n  footnote: string;\n}): ResendInviteContent {\n  const html = `<!doctype html>\n<html>\n  <body style=\"margin:0;padding:24px;background:#f6f6f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;color:#111;\">\n    <div style=\"max-width:480px;margin:0 auto;background:#fff;border-radius:8px;padding:32px;\">\n      <h1 style=\"margin:0 0 12px;font-size:20px;\">${escapeHtml(parts.subject)}</h1>\n      <p style=\"margin:0 0 24px;line-height:1.5;\">${escapeHtml(parts.intro)}</p>\n      <p style=\"margin:0 0 24px;\">\n        <a href=\"${escapeHtml(parts.link)}\" style=\"display:inline-block;background:#111;color:#fff;text-decoration:none;padding:12px 20px;border-radius:6px;font-weight:600;\">${escapeHtml(parts.action)}</a>\n      </p>\n      <p style=\"margin:0;font-size:13px;line-height:1.5;color:#666;\">${escapeHtml(parts.footnote)}</p>\n    </div>\n  </body>\n</html>`;\n  const text = `${parts.subject}\\n\\n${parts.intro}\\n\\n${parts.action}: ${parts.link}\\n\\n${parts.footnote}\\n`;\n  return { subject: parts.subject, html, text };\n}\n\nfunction inviteEmail(event: ResendInviteTemplateEvent): ResendInviteContent {\n  const site = event.siteName;\n  const who = event.invitedBy.includes(\"@\") ? event.invitedBy : \"An admin\";\n\n  if (event.isNewUser === false) {\n    return layout({\n      subject: `You've been added to ${site}`,\n      intro: `${who} added you to ${site} as an ${event.role}. You already have an account, so sign in with the password you already use.`,\n      action: `Open ${site}`,\n      link: event.link,\n      footnote: `Forgot your password? Choose \"Forgot password?\" on the sign-in bar and we'll email you a link to choose a new one.`,\n    });\n  }\n  return layout({\n    subject: `You're invited to edit ${site}`,\n    intro: `${who} invited you to edit ${site} as an ${event.role}. Choose a password to finish setting up your account.`,\n    action: \"Set your password\",\n    link: event.link,\n    footnote: \"This link works once and expires, so open it on the device you'll use. After you set a password, that's how you'll sign in.\",\n  });\n}\n\nconst defaultInviteEmail = inviteEmail;\n\nfunction defaultResetEmail(event: ResendResetTemplateEvent): ResendInviteContent {\n  const site = event.siteName;\n  const intro =\n    event.requestedBy === \"self\"\n      ? `You asked to reset your password for ${site}. Use the button below to choose a new one.`\n      : `An admin of ${site} sent you a link to choose a new password.`;\n  return layout({\n    subject: `Reset your password for ${site}`,\n    intro,\n    action: \"Choose a new password\",\n    link: event.link,\n    footnote: \"This link works once and expires. If you weren't expecting this, you can ignore the email and your password won't change.\",\n  });\n}\n"],"mappings":"AA+CA,MAAM,aAAa;AAEnB,eAAe,KACb,SACA,IACA,SACe;AACf,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI;AAC7C,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,4BAA4B;AAEzD,QAAM,MAAM,MAAM,MAAM,QAAQ,UAAU,YAAY;AAAA,IACpD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,MAAM;AAAA,MAC/B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,QAAQ;AAAA,MACd,IAAI,CAAC,EAAE;AAAA,MACP,SAAS,QAAQ;AAAA,MACjB,MAAM,QAAQ;AAAA,MACd,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC/C,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,SAAS,MAAM,IAAI,KAAK,EAAE;AAAA,MAC9B,CAAC,SAA+B,MAAM;AAAA,MACtC,MAAM;AAAA,IACR;AACA,UAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,IAAI,SAAS,KAAK,MAAM,KAAK,GAAG,EAAE;AAAA,EAC5F;AACF;AAEA,eAAe,WAAW,SAA8B,OAAqC;AAC3F,MAAI,CAAC,MAAM,MAAM;AACf,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAA2C;AAAA,IAC/C,GAAG;AAAA,IACH,MAAM,MAAM;AAAA,IACZ,UAAU,QAAQ,YAAY,MAAM;AAAA,EACtC;AACA,QAAM,KAAK,SAAS,MAAM,OAAO,OAAO,QAAQ,UAAU,oBAAoB,aAAa,CAAC;AAC9F;AAsBO,SAAS,aAAa,SAA8B;AACzD,SAAO,CAAC,UAAwC,WAAW,SAAS,KAAK;AAC3E;AAWO,SAAS,aAAa,SAA6B;AACxD,SAAO;AAAA,IACL,UAAU,CAAC,UAAwC,WAAW,SAAS,KAAK;AAAA,IAC5E,iBAAiB,OAAO,UAA+C;AACrE,YAAM,gBAA0C;AAAA,QAC9C,GAAG;AAAA,QACH,UAAU,QAAQ,YAAY,MAAM;AAAA,MACtC;AACA,YAAM,KAAK,SAAS,MAAM,OAAO,OAAO,QAAQ,eAAe,mBAAmB,aAAa,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,MACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,OAAO;AAC1B;AAOA,SAAS,OAAO,OAMQ;AACtB,QAAM,OAAO;AAAA;AAAA;AAAA;AAAA,oDAIqC,WAAW,MAAM,OAAO,CAAC;AAAA,oDACzB,WAAW,MAAM,KAAK,CAAC;AAAA;AAAA,mBAExD,WAAW,MAAM,IAAI,CAAC,uIAAuI,WAAW,MAAM,MAAM,CAAC;AAAA;AAAA,uEAEjI,WAAW,MAAM,QAAQ,CAAC;AAAA;AAAA;AAAA;AAI/F,QAAM,OAAO,GAAG,MAAM,OAAO;AAAA;AAAA,EAAO,MAAM,KAAK;AAAA;AAAA,EAAO,MAAM,MAAM,KAAK,MAAM,IAAI;AAAA;AAAA,EAAO,MAAM,QAAQ;AAAA;AACtG,SAAO,EAAE,SAAS,MAAM,SAAS,MAAM,KAAK;AAC9C;AAEA,SAAS,YAAY,OAAuD;AAC1E,QAAM,OAAO,MAAM;AACnB,QAAM,MAAM,MAAM,UAAU,SAAS,GAAG,IAAI,MAAM,YAAY;AAE9D,MAAI,MAAM,cAAc,OAAO;AAC7B,WAAO,OAAO;AAAA,MACZ,SAAS,wBAAwB,IAAI;AAAA,MACrC,OAAO,GAAG,GAAG,iBAAiB,IAAI,UAAU,MAAM,IAAI;AAAA,MACtD,QAAQ,QAAQ,IAAI;AAAA,MACpB,MAAM,MAAM;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO,OAAO;AAAA,IACZ,SAAS,0BAA0B,IAAI;AAAA,IACvC,OAAO,GAAG,GAAG,wBAAwB,IAAI,UAAU,MAAM,IAAI;AAAA,IAC7D,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,IACZ,UAAU;AAAA,EACZ,CAAC;AACH;AAEA,MAAM,qBAAqB;AAE3B,SAAS,kBAAkB,OAAsD;AAC/E,QAAM,OAAO,MAAM;AACnB,QAAM,QACJ,MAAM,gBAAgB,SAClB,wCAAwC,IAAI,gDAC5C,eAAe,IAAI;AACzB,SAAO,OAAO;AAAA,IACZ,SAAS,2BAA2B,IAAI;AAAA,IACxC;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,IACZ,UAAU;AAAA,EACZ,CAAC;AACH;","names":[]}

package/dist/index.client.d.ts

@@ -1,10 +1,11 @@
 export { GRail } from './react/GRail/universal.js';
 export { useGRail } from './react/Provider.js';
-export { createAssetUpload, inviteMember, listAssets, listTeam, removeMember, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
+export { createAssetUpload, forgotPasswordAction, inviteMember, listAssets, listTeam, removeMember, sendPasswordResetAction, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { GRepeaterProps, RepeaterItemProps } from './react/Repeater/index.js';
+export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent } from './email/resend.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';
 
@@ -17,5 +18,7 @@ declare const getFieldValue: (..._args: unknown[]) => never;
 declare const isAdmin: (..._args: unknown[]) => never;
 declare const isEditor: (..._args: unknown[]) => never;
 declare const canEdit: (..._args: unknown[]) => never;
+declare const resendInvite: (..._args: unknown[]) => never;
+declare const resendEmails: (..._args: unknown[]) => never;
 
-export { GRepeater, canEdit, configureGuardrail, getFieldValue, getRepeaterItemBySlug, isAdmin, isEditor, listRepeaterItems, withGuardrail };
+export { GRepeater, canEdit, configureGuardrail, getFieldValue, getRepeaterItemBySlug, isAdmin, isEditor, listRepeaterItems, resendEmails, resendInvite, withGuardrail };

package/dist/index.client.js

@@ -9,6 +9,8 @@ import {
   listAssets,
   setPasswordAction,
   skipSetPasswordAction,
+  forgotPasswordAction,
+  sendPasswordResetAction,
   setFieldValue
 } from "./server/actions";
 import {
@@ -59,6 +61,14 @@ const canEdit = serverOnly(
   "canEdit()",
   "Call it in a Server Component; in a Client Component, read `canEdit` from useGRail()."
 );
+const resendInvite = serverOnly(
+  "resendInvite()",
+  "Pass it as onInvite in withGuardrail(), which runs in your root layout."
+);
+const resendEmails = serverOnly(
+  "resendEmails()",
+  "Spread it into withGuardrail(), which runs in your root layout."
+);
 export {
   GRail,
   GRepeater,
@@ -66,6 +76,7 @@ export {
   canEdit,
   configureGuardrail,
   createAssetUpload,
+  forgotPasswordAction,
   getFieldValue,
   getRepeaterItemBySlug,
   inviteMember,
@@ -77,6 +88,9 @@ export {
   removeMember,
   removeRepeaterItem,
   reorderRepeaterItems,
+  resendEmails,
+  resendInvite,
+  sendPasswordResetAction,
   setFieldValue,
   setPasswordAction,
   skipSetPasswordAction,

package/dist/index.client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;","names":[]}
+{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,14 +1,15 @@
 export { withGuardrail } from './server/wrapper.js';
-export { createAssetUpload, inviteMember, listAssets, listTeam, removeMember, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
+export { createAssetUpload, forgotPasswordAction, inviteMember, listAssets, listTeam, removeMember, sendPasswordResetAction, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
 export { GRail } from './react/GRail/index.js';
 export { GRepeater, GRepeaterProps, RepeaterItemProps } from './react/Repeater/index.js';
 export { configureGuardrail } from './core/config.js';
 export { getRepeaterItemBySlug, listRepeaterItems } from './server/repeaterData.js';
 export { getFieldValue } from './server/fieldData.js';
 export { canEdit, isAdmin, isEditor } from './server/access.js';
+export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent, resendEmails, resendInvite } from './email/resend.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { useGRail } from './react/Provider.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/index.js

@@ -8,6 +8,8 @@ import {
   listAssets,
   setPasswordAction,
   skipSetPasswordAction,
+  forgotPasswordAction,
+  sendPasswordResetAction,
   setFieldValue
 } from "./server/actions";
 import { GRail } from "./react/GRail";
@@ -19,6 +21,7 @@ import {
 } from "./server/repeaterData";
 import { getFieldValue } from "./server/fieldData";
 import { isAdmin, isEditor, canEdit } from "./server/access";
+import { resendInvite, resendEmails } from "./email/resend";
 import {
   addRepeaterItem,
   removeRepeaterItem,
@@ -32,6 +35,7 @@ export {
   canEdit,
   configureGuardrail,
   createAssetUpload,
+  forgotPasswordAction,
   getFieldValue,
   getRepeaterItemBySlug,
   inviteMember,
@@ -43,6 +47,9 @@ export {
   removeMember,
   removeRepeaterItem,
   reorderRepeaterItems,
+  resendEmails,
+  resendInvite,
+  sendPasswordResetAction,
   setFieldValue,
   setPasswordAction,
   skipSetPasswordAction,