@guard-rail/core 0.7.1 → 0.9.0

package/dist/react/Icons.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/Icons.tsx"],"sourcesContent":["import React from \"react\";\n\n/**\n * Inline SVG rather than an icon package: Guardrail's chrome should not add a\n * runtime dependency to every consuming app.\n */\nconst base = {\n  width: 14,\n  height: 14,\n  viewBox: \"0 0 24 24\",\n  fill: \"none\",\n  stroke: \"currentColor\",\n  strokeWidth: 3,\n  strokeLinecap: \"round\" as const,\n  strokeLinejoin: \"round\" as const,\n};\n\nexport const CheckIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <polyline points=\"20 6 9 17 4 12\" />\n  </svg>\n);\n\nexport const CloseIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <line x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\" />\n    <line x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\" />\n  </svg>\n);\n\nexport const PencilIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M12 20h9\" />\n    <path d=\"M16.5 3.5a2.121 2.121 0 0 1 3 3L7 19l-4 1 1-4L16.5 3.5z\" />\n  </svg>\n);\n\nexport const PeopleIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2\" />\n    <circle cx=\"9\" cy=\"7\" r=\"4\" />\n    <path d=\"M23 21v-2a4 4 0 0 0-3-3.87\" />\n    <path d=\"M16 3.13a4 4 0 0 1 0 7.75\" />\n  </svg>\n);\n\nexport const PlusIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <line x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\" />\n    <line x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\" />\n  </svg>\n);\n\nexport const TrashIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <polyline points=\"3 6 5 6 21 6\" />\n    <path d=\"M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6\" />\n    <path d=\"M10 11v6M14 11v6M9 6V4a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v2\" />\n  </svg>\n);\n\nexport const ArrowUpIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <line x1=\"12\" y1=\"19\" x2=\"12\" y2=\"5\" />\n    <polyline points=\"6 11 12 5 18 11\" />\n  </svg>\n);\n\nexport const ArrowDownIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <line x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\" />\n    <polyline points=\"18 13 12 19 6 13\" />\n  </svg>\n);\n\nexport const LogOutIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4\" />\n    <polyline points=\"16 17 21 12 16 7\" />\n    <line x1=\"21\" y1=\"12\" x2=\"9\" y2=\"12\" />\n  </svg>\n);\n\nexport const SpinnerIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <path d=\"M21 12a9 9 0 1 1-6.2-8.6\">\n      <animateTransform\n        attributeName=\"transform\"\n        type=\"rotate\"\n        from=\"0 12 12\"\n        to=\"360 12 12\"\n        dur=\"0.7s\"\n        repeatCount=\"indefinite\"\n      />\n    </path>\n  </svg>\n);\n\nexport const OpenIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6\" />\n    <polyline points=\"15 3 21 3 21 9\" />\n    <line x1=\"10\" y1=\"14\" x2=\"21\" y2=\"3\" />\n  </svg>\n);\n"],"mappings":"AAmBI,cAKF,YALE;AAnBJ,OAAO,WAAW;AAMlB,MAAM,OAAO;AAAA,EACX,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEO,MAAM,YAAY,MACvB,oBAAC,SAAK,GAAG,MAAM,eAAY,QACzB,8BAAC,cAAS,QAAO,kBAAiB,GACpC;AAGK,MAAM,YAAY,MACvB,qBAAC,SAAK,GAAG,MAAM,eAAY,QACzB;AAAA,sBAAC,UAAK,IAAG,MAAK,IAAG,KAAI,IAAG,KAAI,IAAG,MAAK;AAAA,EACpC,oBAAC,UAAK,IAAG,KAAI,IAAG,KAAI,IAAG,MAAK,IAAG,MAAK;AAAA,GACtC;AAGK,MAAM,aAAa,MACxB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,UAAK,GAAE,YAAW;AAAA,EACnB,oBAAC,UAAK,GAAE,2DAA0D;AAAA,GACpE;AAGK,MAAM,aAAa,MACxB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,UAAK,GAAE,6CAA4C;AAAA,EACpD,oBAAC,YAAO,IAAG,KAAI,IAAG,KAAI,GAAE,KAAI;AAAA,EAC5B,oBAAC,UAAK,GAAE,8BAA6B;AAAA,EACrC,oBAAC,UAAK,GAAE,6BAA4B;AAAA,GACtC;AAGK,MAAM,WAAW,MACtB,qBAAC,SAAK,GAAG,MAAM,eAAY,QACzB;AAAA,sBAAC,UAAK,IAAG,MAAK,IAAG,KAAI,IAAG,MAAK,IAAG,MAAK;AAAA,EACrC,oBAAC,UAAK,IAAG,KAAI,IAAG,MAAK,IAAG,MAAK,IAAG,MAAK;AAAA,GACvC;AAGK,MAAM,YAAY,MACvB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,cAAS,QAAO,gBAAe;AAAA,EAChC,oBAAC,UAAK,GAAE,iDAAgD;AAAA,EACxD,oBAAC,UAAK,GAAE,0DAAyD;AAAA,GACnE;AAGK,MAAM,cAAc,MACzB,qBAAC,SAAK,GAAG,MAAM,eAAY,QACzB;AAAA,sBAAC,UAAK,IAAG,MAAK,IAAG,MAAK,IAAG,MAAK,IAAG,KAAI;AAAA,EACrC,oBAAC,cAAS,QAAO,mBAAkB;AAAA,GACrC;AAGK,MAAM,gBAAgB,MAC3B,qBAAC,SAAK,GAAG,MAAM,eAAY,QACzB;AAAA,sBAAC,UAAK,IAAG,MAAK,IAAG,KAAI,IAAG,MAAK,IAAG,MAAK;AAAA,EACrC,oBAAC,cAAS,QAAO,oBAAmB;AAAA,GACtC;AAGK,MAAM,aAAa,MACxB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,UAAK,GAAE,2CAA0C;AAAA,EAClD,oBAAC,cAAS,QAAO,oBAAmB;AAAA,EACpC,oBAAC,UAAK,IAAG,MAAK,IAAG,MAAK,IAAG,KAAI,IAAG,MAAK;AAAA,GACvC;AAGK,MAAM,cAAc,MACzB,oBAAC,SAAK,GAAG,MAAM,eAAY,QACzB,8BAAC,UAAK,GAAE,4BACN;AAAA,EAAC;AAAA;AAAA,IACC,eAAc;AAAA,IACd,MAAK;AAAA,IACL,MAAK;AAAA,IACL,IAAG;AAAA,IACH,KAAI;AAAA,IACJ,aAAY;AAAA;AACd,GACF,GACF;AAGK,MAAM,WAAW,MACtB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,UAAK,GAAE,4DAA2D;AAAA,EACnE,oBAAC,cAAS,QAAO,kBAAiB;AAAA,EAClC,oBAAC,UAAK,IAAG,MAAK,IAAG,MAAK,IAAG,MAAK,IAAG,KAAI;AAAA,GACvC;","names":[]}
+{"version":3,"sources":["../../src/react/Icons.tsx"],"sourcesContent":["import React from \"react\";\n\n/**\n * Inline SVG rather than an icon package: Guardrail's chrome should not add a\n * runtime dependency to every consuming app.\n */\nconst base = {\n  width: 14,\n  height: 14,\n  viewBox: \"0 0 24 24\",\n  fill: \"none\",\n  stroke: \"currentColor\",\n  strokeWidth: 3,\n  strokeLinecap: \"round\" as const,\n  strokeLinejoin: \"round\" as const,\n};\n\nexport const CheckIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <polyline points=\"20 6 9 17 4 12\" />\n  </svg>\n);\n\nexport const CloseIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <line x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\" />\n    <line x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\" />\n  </svg>\n);\n\nexport const PencilIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M12 20h9\" />\n    <path d=\"M16.5 3.5a2.121 2.121 0 0 1 3 3L7 19l-4 1 1-4L16.5 3.5z\" />\n  </svg>\n);\n\nexport const PeopleIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2\" />\n    <circle cx=\"9\" cy=\"7\" r=\"4\" />\n    <path d=\"M23 21v-2a4 4 0 0 0-3-3.87\" />\n    <path d=\"M16 3.13a4 4 0 0 1 0 7.75\" />\n  </svg>\n);\n\nexport const PlusIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <line x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\" />\n    <line x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\" />\n  </svg>\n);\n\nexport const TrashIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <polyline points=\"3 6 5 6 21 6\" />\n    <path d=\"M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6\" />\n    <path d=\"M10 11v6M14 11v6M9 6V4a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v2\" />\n  </svg>\n);\n\nexport const ArrowUpIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <line x1=\"12\" y1=\"19\" x2=\"12\" y2=\"5\" />\n    <polyline points=\"6 11 12 5 18 11\" />\n  </svg>\n);\n\nexport const ArrowDownIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <line x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\" />\n    <polyline points=\"18 13 12 19 6 13\" />\n  </svg>\n);\n\nexport const LogOutIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4\" />\n    <polyline points=\"16 17 21 12 16 7\" />\n    <line x1=\"21\" y1=\"12\" x2=\"9\" y2=\"12\" />\n  </svg>\n);\n\nexport const SpinnerIcon = () => (\n  <svg {...base} aria-hidden=\"true\">\n    <path d=\"M21 12a9 9 0 1 1-6.2-8.6\">\n      <animateTransform\n        attributeName=\"transform\"\n        type=\"rotate\"\n        from=\"0 12 12\"\n        to=\"360 12 12\"\n        dur=\"0.7s\"\n        repeatCount=\"indefinite\"\n      />\n    </path>\n  </svg>\n);\n\nexport const OpenIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6\" />\n    <polyline points=\"15 3 21 3 21 9\" />\n    <line x1=\"10\" y1=\"14\" x2=\"21\" y2=\"3\" />\n  </svg>\n);\n\nexport const KeyIcon = () => (\n  <svg {...base} strokeWidth={2} aria-hidden=\"true\">\n    <path d=\"M21 2l-2 2m-7.61 7.61a5.5 5.5 0 1 1-7.778 7.778 5.5 5.5 0 0 1 7.777-7.777zm0 0L15.5 7.5m0 0l3 3L22 7l-3-3m-3.5 3.5L19 4\" />\n  </svg>\n);\n"],"mappings":"AAmBI,cAKF,YALE;AAnBJ,OAAO,WAAW;AAMlB,MAAM,OAAO;AAAA,EACX,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,eAAe;AAAA,EACf,gBAAgB;AAClB;AAEO,MAAM,YAAY,MACvB,oBAAC,SAAK,GAAG,MAAM,eAAY,QACzB,8BAAC,cAAS,QAAO,kBAAiB,GACpC;AAGK,MAAM,YAAY,MACvB,qBAAC,SAAK,GAAG,MAAM,eAAY,QACzB;AAAA,sBAAC,UAAK,IAAG,MAAK,IAAG,KAAI,IAAG,KAAI,IAAG,MAAK;AAAA,EACpC,oBAAC,UAAK,IAAG,KAAI,IAAG,KAAI,IAAG,MAAK,IAAG,MAAK;AAAA,GACtC;AAGK,MAAM,aAAa,MACxB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,UAAK,GAAE,YAAW;AAAA,EACnB,oBAAC,UAAK,GAAE,2DAA0D;AAAA,GACpE;AAGK,MAAM,aAAa,MACxB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,UAAK,GAAE,6CAA4C;AAAA,EACpD,oBAAC,YAAO,IAAG,KAAI,IAAG,KAAI,GAAE,KAAI;AAAA,EAC5B,oBAAC,UAAK,GAAE,8BAA6B;AAAA,EACrC,oBAAC,UAAK,GAAE,6BAA4B;AAAA,GACtC;AAGK,MAAM,WAAW,MACtB,qBAAC,SAAK,GAAG,MAAM,eAAY,QACzB;AAAA,sBAAC,UAAK,IAAG,MAAK,IAAG,KAAI,IAAG,MAAK,IAAG,MAAK;AAAA,EACrC,oBAAC,UAAK,IAAG,KAAI,IAAG,MAAK,IAAG,MAAK,IAAG,MAAK;AAAA,GACvC;AAGK,MAAM,YAAY,MACvB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,cAAS,QAAO,gBAAe;AAAA,EAChC,oBAAC,UAAK,GAAE,iDAAgD;AAAA,EACxD,oBAAC,UAAK,GAAE,0DAAyD;AAAA,GACnE;AAGK,MAAM,cAAc,MACzB,qBAAC,SAAK,GAAG,MAAM,eAAY,QACzB;AAAA,sBAAC,UAAK,IAAG,MAAK,IAAG,MAAK,IAAG,MAAK,IAAG,KAAI;AAAA,EACrC,oBAAC,cAAS,QAAO,mBAAkB;AAAA,GACrC;AAGK,MAAM,gBAAgB,MAC3B,qBAAC,SAAK,GAAG,MAAM,eAAY,QACzB;AAAA,sBAAC,UAAK,IAAG,MAAK,IAAG,KAAI,IAAG,MAAK,IAAG,MAAK;AAAA,EACrC,oBAAC,cAAS,QAAO,oBAAmB;AAAA,GACtC;AAGK,MAAM,aAAa,MACxB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,UAAK,GAAE,2CAA0C;AAAA,EAClD,oBAAC,cAAS,QAAO,oBAAmB;AAAA,EACpC,oBAAC,UAAK,IAAG,MAAK,IAAG,MAAK,IAAG,KAAI,IAAG,MAAK;AAAA,GACvC;AAGK,MAAM,cAAc,MACzB,oBAAC,SAAK,GAAG,MAAM,eAAY,QACzB,8BAAC,UAAK,GAAE,4BACN;AAAA,EAAC;AAAA;AAAA,IACC,eAAc;AAAA,IACd,MAAK;AAAA,IACL,MAAK;AAAA,IACL,IAAG;AAAA,IACH,KAAI;AAAA,IACJ,aAAY;AAAA;AACd,GACF,GACF;AAGK,MAAM,WAAW,MACtB,qBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC;AAAA,sBAAC,UAAK,GAAE,4DAA2D;AAAA,EACnE,oBAAC,cAAS,QAAO,kBAAiB;AAAA,EAClC,oBAAC,UAAK,IAAG,MAAK,IAAG,MAAK,IAAG,MAAK,IAAG,KAAI;AAAA,GACvC;AAGK,MAAM,UAAU,MACrB,oBAAC,SAAK,GAAG,MAAM,aAAa,GAAG,eAAY,QACzC,8BAAC,UAAK,GAAE,2HAA0H,GACpI;","names":[]}

package/dist/react/Team.d.ts

@@ -1,7 +1,13 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 
+/**
+ * Keyframes cannot be expressed as inline styles, so the drawer ships the few
+ * it needs. Scoped to [data-guardrail-team] to stay clear of app styles, and
+ * disabled under prefers-reduced-motion.
+ */
+declare const ANIMATION_CSS = "\n@keyframes gr-fade-in { from { opacity: 0 } to { opacity: 1 } }\n@keyframes gr-slide-in {\n  from { transform: translateX(100%) }\n  to   { transform: translateX(0) }\n}\n[data-guardrail-scrim] { animation: gr-fade-in 160ms ease-out both }\n[data-guardrail-team]  { animation: gr-slide-in 220ms cubic-bezier(0.32, 0.72, 0, 1) both }\n[data-guardrail-team] [data-gr-row] { animation: gr-fade-in 240ms ease-out both }\n@keyframes gr-fade-out { from { opacity: 1 } to { opacity: 0 } }\n@keyframes gr-slide-out {\n  from { transform: translateX(0) }\n  to   { transform: translateX(100%) }\n}\n[data-guardrail-scrim][data-closing] { animation: gr-fade-out 180ms ease-in both }\n[data-guardrail-team][data-closing]  { animation: gr-slide-out 180ms cubic-bezier(0.4, 0, 1, 1) both }\n@media (prefers-reduced-motion: reduce) {\n  [data-guardrail-scrim], [data-guardrail-team], [data-guardrail-team] [data-gr-row] {\n    animation: none\n  }\n}\n";
 declare function TeamDrawer({ onClose }: {
     onClose: () => void;
 }): react_jsx_runtime.JSX.Element;
 
-export { TeamDrawer };
+export { ANIMATION_CSS, TeamDrawer };

package/dist/react/Team.js

@@ -5,10 +5,11 @@ import {
   inviteMember,
   listTeam,
   removeMember,
+  sendPasswordResetAction,
   updateMemberRole
 } from "../server/actions";
 import { useGRail } from "./Provider";
-import { CloseIcon } from "./Icons";
+import { CloseIcon, KeyIcon } from "./Icons";
 import { S, v } from "./styles";
 const ROLES = ["admin", "editor"];
 const ANIMATION_CSS = `
@@ -39,6 +40,7 @@ function TeamDrawer({ onClose }) {
   const [members, setMembers] = useState([]);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState(null);
+  const [notice, setNotice] = useState(null);
   const [inviteEmail, setInviteEmail] = useState("");
   const [inviteRole, setInviteRole] = useState("editor");
   const [pending, startTransition] = useTransition();
@@ -51,8 +53,10 @@ function TeamDrawer({ onClose }) {
   }, []);
   const run = (fn) => startTransition(async () => {
     setError(null);
+    setNotice(null);
     const res = await fn();
     if (!res.success) setError(res.error ?? "Something went wrong.");
+    else if (res.notice) setNotice(res.notice);
     await refresh();
   });
   const [closing, setClosing] = useState(false);
@@ -102,6 +106,7 @@ function TeamDrawer({ onClose }) {
           ] }),
           /* @__PURE__ */ jsxs("div", { style: S.drawerBody, children: [
             error && /* @__PURE__ */ jsx("div", { style: { ...S.error, marginBottom: 12 }, children: error }),
+            notice && /* @__PURE__ */ jsx("div", { style: { fontSize: 12, color: v("muted"), marginBottom: 12 }, role: "status", children: notice }),
             loading ? /* @__PURE__ */ jsx("p", { style: { fontSize: 13, color: v("muted") }, children: "Loading\u2026" }) : members.map((m) => /* @__PURE__ */ jsxs("div", { "data-gr-row": true, style: S.memberRow, children: [
               /* @__PURE__ */ jsxs("span", { style: S.memberEmail, title: m.email, children: [
                 m.email,
@@ -120,6 +125,17 @@ function TeamDrawer({ onClose }) {
                   children: ROLES.map((r) => /* @__PURE__ */ jsx("option", { value: r, children: r }, r))
                 }
               ) : /* @__PURE__ */ jsx("span", { style: { fontSize: 12, color: v("muted") }, children: m.role }),
+              isAdmin && /* @__PURE__ */ jsx(
+                "button",
+                {
+                  style: { ...S.iconBtn, color: v("muted"), width: 22, height: 22 },
+                  disabled: pending,
+                  onClick: () => run(() => sendPasswordResetAction(m.email)),
+                  "aria-label": `Send password reset to ${m.email}`,
+                  title: "Send password reset",
+                  children: /* @__PURE__ */ jsx(KeyIcon, {})
+                }
+              ),
               isAdmin && /* @__PURE__ */ jsx(
                 "button",
                 {
@@ -173,9 +189,12 @@ function TeamDrawer({ onClose }) {
                 }
               ),
               /* @__PURE__ */ jsxs("p", { style: { fontSize: 11, color: v("subtle"), marginTop: 10 }, children: [
-                "Guardrail records the invite. Sending the email is your app's job \u2014 wire the ",
+                "New people get an email to set a password. Invites and resets go out through your ",
                 /* @__PURE__ */ jsx("code", { children: "onInvite" }),
-                " handler."
+                " / ",
+                /* @__PURE__ */ jsx("code", { children: "onPasswordReset" }),
+                " ",
+                "handlers, or your auth provider's own emails if you haven't set them."
               ] })
             ] })
           ] })
@@ -185,6 +204,7 @@ function TeamDrawer({ onClose }) {
   ] });
 }
 export {
+  ANIMATION_CSS,
   TeamDrawer
 };
 //# sourceMappingURL=Team.js.map

package/dist/react/Team.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/Team.tsx"],"sourcesContent":["\"use client\";\n\nimport React, { useCallback, useEffect, useState, useTransition } from \"react\";\nimport {\n  inviteMember,\n  listTeam,\n  removeMember,\n  updateMemberRole,\n} from \"../server/actions\";\nimport { useGRail } from \"./Provider\";\nimport { CloseIcon } from \"./Icons\";\nimport { S, v } from \"./styles\";\nimport type { GRMember, GRRole } from \"../core/types\";\n\nconst ROLES: GRRole[] = [\"admin\", \"editor\"];\n\n/**\n * Keyframes cannot be expressed as inline styles, so the drawer ships the few\n * it needs. Scoped to [data-guardrail-team] to stay clear of app styles, and\n * disabled under prefers-reduced-motion.\n */\nconst ANIMATION_CSS = `\n@keyframes gr-fade-in { from { opacity: 0 } to { opacity: 1 } }\n@keyframes gr-slide-in {\n  from { transform: translateX(100%) }\n  to   { transform: translateX(0) }\n}\n[data-guardrail-scrim] { animation: gr-fade-in 160ms ease-out both }\n[data-guardrail-team]  { animation: gr-slide-in 220ms cubic-bezier(0.32, 0.72, 0, 1) both }\n[data-guardrail-team] [data-gr-row] { animation: gr-fade-in 240ms ease-out both }\n@keyframes gr-fade-out { from { opacity: 1 } to { opacity: 0 } }\n@keyframes gr-slide-out {\n  from { transform: translateX(0) }\n  to   { transform: translateX(100%) }\n}\n[data-guardrail-scrim][data-closing] { animation: gr-fade-out 180ms ease-in both }\n[data-guardrail-team][data-closing]  { animation: gr-slide-out 180ms cubic-bezier(0.4, 0, 1, 1) both }\n@media (prefers-reduced-motion: reduce) {\n  [data-guardrail-scrim], [data-guardrail-team], [data-guardrail-team] [data-gr-row] {\n    animation: none\n  }\n}\n`;\n\nexport function TeamDrawer({ onClose }: { onClose: () => void }) {\n  const { role, email: currentEmail } = useGRail();\n  const isAdmin = role === \"admin\";\n\n  const [members, setMembers] = useState<GRMember[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [inviteEmail, setInviteEmail] = useState(\"\");\n  const [inviteRole, setInviteRole] = useState<GRRole>(\"editor\");\n  const [pending, startTransition] = useTransition();\n\n  const refresh = () =>\n    listTeam().then((rows) => {\n      setMembers(rows);\n      setLoading(false);\n    });\n\n  useEffect(() => {\n    void refresh();\n  }, []);\n\n  // Server actions re-check the role; this only decides what to render.\n  // Always refresh: a failure can still have changed the roster (an invite\n  // that saved but whose email failed, for instance).\n  const run = (fn: () => Promise<{ success: boolean; error?: string }>) =>\n    startTransition(async () => {\n      setError(null);\n      const res = await fn();\n      if (!res.success) setError(res.error ?? \"Something went wrong.\");\n      await refresh();\n    });\n\n  /**\n   * Unmounting on close skips the exit animation entirely. Stay mounted, play\n   * it, and let the parent unmount once it finishes.\n   */\n  const [closing, setClosing] = useState(false);\n  const requestClose = useCallback(() => {\n    const reduced =\n      typeof window !== \"undefined\" &&\n      window.matchMedia(\"(prefers-reduced-motion: reduce)\").matches;\n    if (reduced) return onClose(); // No animation, so no animationend to wait for.\n    setClosing(true);\n  }, [onClose]);\n\n  useEffect(() => {\n    if (!closing) return;\n    // Safety net if animationend never arrives (tab hidden, styles stripped).\n    const t = window.setTimeout(onClose, 400);\n    return () => window.clearTimeout(t);\n  }, [closing, onClose]);\n\n  useEffect(() => {\n    const onKey = (e: KeyboardEvent) => e.key === \"Escape\" && requestClose();\n    window.addEventListener(\"keydown\", onKey);\n    return () => window.removeEventListener(\"keydown\", onKey);\n  }, [requestClose]);\n\n  return (\n    <>\n      {/* Hoisted to <head> — see the note on the theme <style> in Admin.tsx. */}\n      <style href=\"guardrail-team-animation\" precedence=\"default\">\n        {ANIMATION_CSS}\n      </style>\n      <div\n        data-guardrail\n        data-guardrail-scrim\n        {...(closing ? { \"data-closing\": \"\" } : {})}\n        style={S.scrim}\n        onClick={requestClose}\n      />\n      <aside\n        data-guardrail\n        data-guardrail-team\n        {...(closing ? { \"data-closing\": \"\" } : {})}\n        onAnimationEnd={(e) => {\n          // Row fade-ins bubble up here too; only the drawer's own exit counts.\n          if (closing && e.target === e.currentTarget) onClose();\n        }}\n        style={S.drawer}\n        role=\"dialog\"\n        aria-label=\"Team\"\n      >\n        <header style={S.drawerHead}>\n          <h2 style={S.drawerTitle}>Team</h2>\n          <button style={{ ...S.iconBtn, color: v(\"muted\") }} onClick={requestClose} aria-label=\"Close\">\n            <CloseIcon />\n          </button>\n        </header>\n\n        <div style={S.drawerBody}>\n          {error && <div style={{ ...S.error, marginBottom: 12 }}>{error}</div>}\n\n          {loading ? (\n            <p style={{ fontSize: 13, color: v(\"muted\") }}>Loading…</p>\n          ) : (\n            members.map((m) => (\n              <div key={m.email} data-gr-row style={S.memberRow}>\n                <span style={S.memberEmail} title={m.email}>\n                  {m.email}\n                  {m.email === currentEmail && \" (you)\"}\n                </span>\n\n                {m.status === \"pending\" && <span style={S.badge}>Invited</span>}\n\n                {isAdmin ? (\n                  <select\n                    style={S.select}\n                    value={m.role}\n                    disabled={pending}\n                    onChange={(e) =>\n                      run(() =>\n                        updateMemberRole(m.email, e.target.value as GRRole),\n                      )\n                    }\n                  >\n                    {ROLES.map((r) => (\n                      <option key={r} value={r}>\n                        {r}\n                      </option>\n                    ))}\n                  </select>\n                ) : (\n                  <span style={{ fontSize: 12, color: v(\"muted\") }}>{m.role}</span>\n                )}\n\n                {isAdmin && (\n                  <button\n                    style={{ ...S.iconBtn, color: v(\"muted\"), width: 22, height: 22 }}\n                    disabled={pending}\n                    onClick={() => run(() => removeMember(m.email))}\n                    aria-label={`Remove ${m.email}`}\n                    title=\"Remove\"\n                  >\n                    <CloseIcon />\n                  </button>\n                )}\n              </div>\n            ))\n          )}\n\n          {isAdmin && (\n            <>\n              <p style={S.sectionLabel}>Invite someone</p>\n              <form\n                onSubmit={(e) => {\n                  e.preventDefault();\n                  run(async () => {\n                    const res = await inviteMember(inviteEmail, inviteRole);\n                    if (res.success) setInviteEmail(\"\");\n                    return res;\n                  });\n                }}\n              >\n                <input\n                  style={S.field}\n                  type=\"email\"\n                  placeholder=\"name@company.com\"\n                  value={inviteEmail}\n                  onChange={(e) => setInviteEmail(e.target.value)}\n                  required\n                />\n                <div style={{ display: \"flex\", gap: 8 }}>\n                  <select\n                    style={{ ...S.select, flex: 1 }}\n                    value={inviteRole}\n                    onChange={(e) => setInviteRole(e.target.value as GRRole)}\n                  >\n                    {ROLES.map((r) => (\n                      <option key={r} value={r}>\n                        {r}\n                      </option>\n                    ))}\n                  </select>\n                  <button style={S.primaryBtn} type=\"submit\" disabled={pending}>\n                    {pending ? \"Working…\" : \"Invite\"}\n                  </button>\n                </div>\n              </form>\n              <p style={{ fontSize: 11, color: v(\"subtle\"), marginTop: 10 }}>\n                Guardrail records the invite. Sending the email is your app&apos;s\n                job — wire the <code>onInvite</code> handler.\n              </p>\n            </>\n          )}\n        </div>\n      </aside>\n    </>\n  );\n}\n"],"mappings":";AAyGM,SAiFM,UAjFN,KAsBE,YAtBF;AAvGN,OAAO,SAAS,aAAa,WAAW,UAAU,qBAAqB;AACvE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAC1B,SAAS,GAAG,SAAS;AAGrB,MAAM,QAAkB,CAAC,SAAS,QAAQ;AAO1C,MAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBf,SAAS,WAAW,EAAE,QAAQ,GAA4B;AAC/D,QAAM,EAAE,MAAM,OAAO,aAAa,IAAI,SAAS;AAC/C,QAAM,UAAU,SAAS;AAEzB,QAAM,CAAC,SAAS,UAAU,IAAI,SAAqB,CAAC,CAAC;AACrD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,IAAI;AAC3C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,EAAE;AACjD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAiB,QAAQ;AAC7D,QAAM,CAAC,SAAS,eAAe,IAAI,cAAc;AAEjD,QAAM,UAAU,MACd,SAAS,EAAE,KAAK,CAAC,SAAS;AACxB,eAAW,IAAI;AACf,eAAW,KAAK;AAAA,EAClB,CAAC;AAEH,YAAU,MAAM;AACd,SAAK,QAAQ;AAAA,EACf,GAAG,CAAC,CAAC;AAKL,QAAM,MAAM,CAAC,OACX,gBAAgB,YAAY;AAC1B,aAAS,IAAI;AACb,UAAM,MAAM,MAAM,GAAG;AACrB,QAAI,CAAC,IAAI,QAAS,UAAS,IAAI,SAAS,uBAAuB;AAC/D,UAAM,QAAQ;AAAA,EAChB,CAAC;AAMH,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,eAAe,YAAY,MAAM;AACrC,UAAM,UACJ,OAAO,WAAW,eAClB,OAAO,WAAW,kCAAkC,EAAE;AACxD,QAAI,QAAS,QAAO,QAAQ;AAC5B,eAAW,IAAI;AAAA,EACjB,GAAG,CAAC,OAAO,CAAC;AAEZ,YAAU,MAAM;AACd,QAAI,CAAC,QAAS;AAEd,UAAM,IAAI,OAAO,WAAW,SAAS,GAAG;AACxC,WAAO,MAAM,OAAO,aAAa,CAAC;AAAA,EACpC,GAAG,CAAC,SAAS,OAAO,CAAC;AAErB,YAAU,MAAM;AACd,UAAM,QAAQ,CAAC,MAAqB,EAAE,QAAQ,YAAY,aAAa;AACvE,WAAO,iBAAiB,WAAW,KAAK;AACxC,WAAO,MAAM,OAAO,oBAAoB,WAAW,KAAK;AAAA,EAC1D,GAAG,CAAC,YAAY,CAAC;AAEjB,SACE,iCAEE;AAAA,wBAAC,WAAM,MAAK,4BAA2B,YAAW,WAC/C,yBACH;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,kBAAc;AAAA,QACd,wBAAoB;AAAA,QACnB,GAAI,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;AAAA,QACzC,OAAO,EAAE;AAAA,QACT,SAAS;AAAA;AAAA,IACX;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,kBAAc;AAAA,QACd,uBAAmB;AAAA,QAClB,GAAI,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;AAAA,QACzC,gBAAgB,CAAC,MAAM;AAErB,cAAI,WAAW,EAAE,WAAW,EAAE,cAAe,SAAQ;AAAA,QACvD;AAAA,QACA,OAAO,EAAE;AAAA,QACT,MAAK;AAAA,QACL,cAAW;AAAA,QAEX;AAAA,+BAAC,YAAO,OAAO,EAAE,YACf;AAAA,gCAAC,QAAG,OAAO,EAAE,aAAa,kBAAI;AAAA,YAC9B,oBAAC,YAAO,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE,GAAG,SAAS,cAAc,cAAW,SACpF,8BAAC,aAAU,GACb;AAAA,aACF;AAAA,UAEA,qBAAC,SAAI,OAAO,EAAE,YACX;AAAA,qBAAS,oBAAC,SAAI,OAAO,EAAE,GAAG,EAAE,OAAO,cAAc,GAAG,GAAI,iBAAM;AAAA,YAE9D,UACC,oBAAC,OAAE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,GAAG,2BAAQ,IAEvD,QAAQ,IAAI,CAAC,MACX,qBAAC,SAAkB,eAAW,MAAC,OAAO,EAAE,WACtC;AAAA,mCAAC,UAAK,OAAO,EAAE,aAAa,OAAO,EAAE,OAClC;AAAA,kBAAE;AAAA,gBACF,EAAE,UAAU,gBAAgB;AAAA,iBAC/B;AAAA,cAEC,EAAE,WAAW,aAAa,oBAAC,UAAK,OAAO,EAAE,OAAO,qBAAO;AAAA,cAEvD,UACC;AAAA,gBAAC;AAAA;AAAA,kBACC,OAAO,EAAE;AAAA,kBACT,OAAO,EAAE;AAAA,kBACT,UAAU;AAAA,kBACV,UAAU,CAAC,MACT;AAAA,oBAAI,MACF,iBAAiB,EAAE,OAAO,EAAE,OAAO,KAAe;AAAA,kBACpD;AAAA,kBAGD,gBAAM,IAAI,CAAC,MACV,oBAAC,YAAe,OAAO,GACpB,eADU,CAEb,CACD;AAAA;AAAA,cACH,IAEA,oBAAC,UAAK,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,GAAI,YAAE,MAAK;AAAA,cAG3D,WACC;AAAA,gBAAC;AAAA;AAAA,kBACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AAAA,kBAChE,UAAU;AAAA,kBACV,SAAS,MAAM,IAAI,MAAM,aAAa,EAAE,KAAK,CAAC;AAAA,kBAC9C,cAAY,UAAU,EAAE,KAAK;AAAA,kBAC7B,OAAM;AAAA,kBAEN,8BAAC,aAAU;AAAA;AAAA,cACb;AAAA,iBAtCM,EAAE,KAwCZ,CACD;AAAA,YAGF,WACC,iCACE;AAAA,kCAAC,OAAE,OAAO,EAAE,cAAc,4BAAc;AAAA,cACxC;AAAA,gBAAC;AAAA;AAAA,kBACC,UAAU,CAAC,MAAM;AACf,sBAAE,eAAe;AACjB,wBAAI,YAAY;AACd,4BAAM,MAAM,MAAM,aAAa,aAAa,UAAU;AACtD,0BAAI,IAAI,QAAS,gBAAe,EAAE;AAClC,6BAAO;AAAA,oBACT,CAAC;AAAA,kBACH;AAAA,kBAEA;AAAA;AAAA,sBAAC;AAAA;AAAA,wBACC,OAAO,EAAE;AAAA,wBACT,MAAK;AAAA,wBACL,aAAY;AAAA,wBACZ,OAAO;AAAA,wBACP,UAAU,CAAC,MAAM,eAAe,EAAE,OAAO,KAAK;AAAA,wBAC9C,UAAQ;AAAA;AAAA,oBACV;AAAA,oBACA,qBAAC,SAAI,OAAO,EAAE,SAAS,QAAQ,KAAK,EAAE,GACpC;AAAA;AAAA,wBAAC;AAAA;AAAA,0BACC,OAAO,EAAE,GAAG,EAAE,QAAQ,MAAM,EAAE;AAAA,0BAC9B,OAAO;AAAA,0BACP,UAAU,CAAC,MAAM,cAAc,EAAE,OAAO,KAAe;AAAA,0BAEtD,gBAAM,IAAI,CAAC,MACV,oBAAC,YAAe,OAAO,GACpB,eADU,CAEb,CACD;AAAA;AAAA,sBACH;AAAA,sBACA,oBAAC,YAAO,OAAO,EAAE,YAAY,MAAK,UAAS,UAAU,SAClD,oBAAU,kBAAa,UAC1B;AAAA,uBACF;AAAA;AAAA;AAAA,cACF;AAAA,cACA,qBAAC,OAAE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,QAAQ,GAAG,WAAW,GAAG,GAAG;AAAA;AAAA,gBAE9C,oBAAC,UAAK,sBAAQ;AAAA,gBAAO;AAAA,iBACtC;AAAA,eACF;AAAA,aAEJ;AAAA;AAAA;AAAA,IACF;AAAA,KACF;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/react/Team.tsx"],"sourcesContent":["\"use client\";\n\nimport React, { useCallback, useEffect, useState, useTransition } from \"react\";\nimport {\n  inviteMember,\n  listTeam,\n  removeMember,\n  sendPasswordResetAction,\n  updateMemberRole,\n} from \"../server/actions\";\nimport { useGRail } from \"./Provider\";\nimport { CloseIcon, KeyIcon } from \"./Icons\";\nimport { S, v } from \"./styles\";\nimport type { GRMember, GRRole } from \"../core/types\";\n\nconst ROLES: GRRole[] = [\"admin\", \"editor\"];\n\n/**\n * Keyframes cannot be expressed as inline styles, so the drawer ships the few\n * it needs. Scoped to [data-guardrail-team] to stay clear of app styles, and\n * disabled under prefers-reduced-motion.\n */\nexport const ANIMATION_CSS = `\n@keyframes gr-fade-in { from { opacity: 0 } to { opacity: 1 } }\n@keyframes gr-slide-in {\n  from { transform: translateX(100%) }\n  to   { transform: translateX(0) }\n}\n[data-guardrail-scrim] { animation: gr-fade-in 160ms ease-out both }\n[data-guardrail-team]  { animation: gr-slide-in 220ms cubic-bezier(0.32, 0.72, 0, 1) both }\n[data-guardrail-team] [data-gr-row] { animation: gr-fade-in 240ms ease-out both }\n@keyframes gr-fade-out { from { opacity: 1 } to { opacity: 0 } }\n@keyframes gr-slide-out {\n  from { transform: translateX(0) }\n  to   { transform: translateX(100%) }\n}\n[data-guardrail-scrim][data-closing] { animation: gr-fade-out 180ms ease-in both }\n[data-guardrail-team][data-closing]  { animation: gr-slide-out 180ms cubic-bezier(0.4, 0, 1, 1) both }\n@media (prefers-reduced-motion: reduce) {\n  [data-guardrail-scrim], [data-guardrail-team], [data-guardrail-team] [data-gr-row] {\n    animation: none\n  }\n}\n`;\n\nexport function TeamDrawer({ onClose }: { onClose: () => void }) {\n  const { role, email: currentEmail } = useGRail();\n  const isAdmin = role === \"admin\";\n\n  const [members, setMembers] = useState<GRMember[]>([]);\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const [notice, setNotice] = useState<string | null>(null);\n  const [inviteEmail, setInviteEmail] = useState(\"\");\n  const [inviteRole, setInviteRole] = useState<GRRole>(\"editor\");\n  const [pending, startTransition] = useTransition();\n\n  const refresh = () =>\n    listTeam().then((rows) => {\n      setMembers(rows);\n      setLoading(false);\n    });\n\n  useEffect(() => {\n    void refresh();\n  }, []);\n\n  // Server actions re-check the role; this only decides what to render.\n  // Always refresh: a failure can still have changed the roster (an invite\n  // that saved but whose email failed, for instance).\n  const run = (fn: () => Promise<{ success: boolean; error?: string; notice?: string }>) =>\n    startTransition(async () => {\n      setError(null);\n      setNotice(null);\n      const res = await fn();\n      if (!res.success) setError(res.error ?? \"Something went wrong.\");\n      else if (res.notice) setNotice(res.notice);\n      await refresh();\n    });\n\n  /**\n   * Unmounting on close skips the exit animation entirely. Stay mounted, play\n   * it, and let the parent unmount once it finishes.\n   */\n  const [closing, setClosing] = useState(false);\n  const requestClose = useCallback(() => {\n    const reduced =\n      typeof window !== \"undefined\" &&\n      window.matchMedia(\"(prefers-reduced-motion: reduce)\").matches;\n    if (reduced) return onClose(); // No animation, so no animationend to wait for.\n    setClosing(true);\n  }, [onClose]);\n\n  useEffect(() => {\n    if (!closing) return;\n    // Safety net if animationend never arrives (tab hidden, styles stripped).\n    const t = window.setTimeout(onClose, 400);\n    return () => window.clearTimeout(t);\n  }, [closing, onClose]);\n\n  useEffect(() => {\n    const onKey = (e: KeyboardEvent) => e.key === \"Escape\" && requestClose();\n    window.addEventListener(\"keydown\", onKey);\n    return () => window.removeEventListener(\"keydown\", onKey);\n  }, [requestClose]);\n\n  return (\n    <>\n      {/* Hoisted to <head> — see the note on the theme <style> in Admin.tsx. */}\n      <style href=\"guardrail-team-animation\" precedence=\"default\">\n        {ANIMATION_CSS}\n      </style>\n      <div\n        data-guardrail\n        data-guardrail-scrim\n        {...(closing ? { \"data-closing\": \"\" } : {})}\n        style={S.scrim}\n        onClick={requestClose}\n      />\n      <aside\n        data-guardrail\n        data-guardrail-team\n        {...(closing ? { \"data-closing\": \"\" } : {})}\n        onAnimationEnd={(e) => {\n          // Row fade-ins bubble up here too; only the drawer's own exit counts.\n          if (closing && e.target === e.currentTarget) onClose();\n        }}\n        style={S.drawer}\n        role=\"dialog\"\n        aria-label=\"Team\"\n      >\n        <header style={S.drawerHead}>\n          <h2 style={S.drawerTitle}>Team</h2>\n          <button style={{ ...S.iconBtn, color: v(\"muted\") }} onClick={requestClose} aria-label=\"Close\">\n            <CloseIcon />\n          </button>\n        </header>\n\n        <div style={S.drawerBody}>\n          {error && <div style={{ ...S.error, marginBottom: 12 }}>{error}</div>}\n          {notice && (\n            <div style={{ fontSize: 12, color: v(\"muted\"), marginBottom: 12 }} role=\"status\">\n              {notice}\n            </div>\n          )}\n\n          {loading ? (\n            <p style={{ fontSize: 13, color: v(\"muted\") }}>Loading…</p>\n          ) : (\n            members.map((m) => (\n              <div key={m.email} data-gr-row style={S.memberRow}>\n                <span style={S.memberEmail} title={m.email}>\n                  {m.email}\n                  {m.email === currentEmail && \" (you)\"}\n                </span>\n\n                {m.status === \"pending\" && <span style={S.badge}>Invited</span>}\n\n                {isAdmin ? (\n                  <select\n                    style={S.select}\n                    value={m.role}\n                    disabled={pending}\n                    onChange={(e) =>\n                      run(() =>\n                        updateMemberRole(m.email, e.target.value as GRRole),\n                      )\n                    }\n                  >\n                    {ROLES.map((r) => (\n                      <option key={r} value={r}>\n                        {r}\n                      </option>\n                    ))}\n                  </select>\n                ) : (\n                  <span style={{ fontSize: 12, color: v(\"muted\") }}>{m.role}</span>\n                )}\n\n                {isAdmin && (\n                  <button\n                    style={{ ...S.iconBtn, color: v(\"muted\"), width: 22, height: 22 }}\n                    disabled={pending}\n                    onClick={() => run(() => sendPasswordResetAction(m.email))}\n                    aria-label={`Send password reset to ${m.email}`}\n                    title=\"Send password reset\"\n                  >\n                    <KeyIcon />\n                  </button>\n                )}\n\n                {isAdmin && (\n                  <button\n                    style={{ ...S.iconBtn, color: v(\"muted\"), width: 22, height: 22 }}\n                    disabled={pending}\n                    onClick={() => run(() => removeMember(m.email))}\n                    aria-label={`Remove ${m.email}`}\n                    title=\"Remove\"\n                  >\n                    <CloseIcon />\n                  </button>\n                )}\n              </div>\n            ))\n          )}\n\n          {isAdmin && (\n            <>\n              <p style={S.sectionLabel}>Invite someone</p>\n              <form\n                onSubmit={(e) => {\n                  e.preventDefault();\n                  run(async () => {\n                    const res = await inviteMember(inviteEmail, inviteRole);\n                    if (res.success) setInviteEmail(\"\");\n                    return res;\n                  });\n                }}\n              >\n                <input\n                  style={S.field}\n                  type=\"email\"\n                  placeholder=\"name@company.com\"\n                  value={inviteEmail}\n                  onChange={(e) => setInviteEmail(e.target.value)}\n                  required\n                />\n                <div style={{ display: \"flex\", gap: 8 }}>\n                  <select\n                    style={{ ...S.select, flex: 1 }}\n                    value={inviteRole}\n                    onChange={(e) => setInviteRole(e.target.value as GRRole)}\n                  >\n                    {ROLES.map((r) => (\n                      <option key={r} value={r}>\n                        {r}\n                      </option>\n                    ))}\n                  </select>\n                  <button style={S.primaryBtn} type=\"submit\" disabled={pending}>\n                    {pending ? \"Working…\" : \"Invite\"}\n                  </button>\n                </div>\n              </form>\n              <p style={{ fontSize: 11, color: v(\"subtle\"), marginTop: 10 }}>\n                New people get an email to set a password. Invites and resets go\n                out through your <code>onInvite</code> / <code>onPasswordReset</code>{\" \"}\n                handlers, or your auth provider&apos;s own emails if you haven&apos;t\n                set them.\n              </p>\n            </>\n          )}\n        </div>\n      </aside>\n    </>\n  );\n}\n"],"mappings":";AA6GM,SAkGM,UAlGN,KAsBE,YAtBF;AA3GN,OAAO,SAAS,aAAa,WAAW,UAAU,qBAAqB;AACvE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AACzB,SAAS,WAAW,eAAe;AACnC,SAAS,GAAG,SAAS;AAGrB,MAAM,QAAkB,CAAC,SAAS,QAAQ;AAOnC,MAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBtB,SAAS,WAAW,EAAE,QAAQ,GAA4B;AAC/D,QAAM,EAAE,MAAM,OAAO,aAAa,IAAI,SAAS;AAC/C,QAAM,UAAU,SAAS;AAEzB,QAAM,CAAC,SAAS,UAAU,IAAI,SAAqB,CAAC,CAAC;AACrD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,IAAI;AAC3C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAwB,IAAI;AACxD,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,EAAE;AACjD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAiB,QAAQ;AAC7D,QAAM,CAAC,SAAS,eAAe,IAAI,cAAc;AAEjD,QAAM,UAAU,MACd,SAAS,EAAE,KAAK,CAAC,SAAS;AACxB,eAAW,IAAI;AACf,eAAW,KAAK;AAAA,EAClB,CAAC;AAEH,YAAU,MAAM;AACd,SAAK,QAAQ;AAAA,EACf,GAAG,CAAC,CAAC;AAKL,QAAM,MAAM,CAAC,OACX,gBAAgB,YAAY;AAC1B,aAAS,IAAI;AACb,cAAU,IAAI;AACd,UAAM,MAAM,MAAM,GAAG;AACrB,QAAI,CAAC,IAAI,QAAS,UAAS,IAAI,SAAS,uBAAuB;AAAA,aACtD,IAAI,OAAQ,WAAU,IAAI,MAAM;AACzC,UAAM,QAAQ;AAAA,EAChB,CAAC;AAMH,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,eAAe,YAAY,MAAM;AACrC,UAAM,UACJ,OAAO,WAAW,eAClB,OAAO,WAAW,kCAAkC,EAAE;AACxD,QAAI,QAAS,QAAO,QAAQ;AAC5B,eAAW,IAAI;AAAA,EACjB,GAAG,CAAC,OAAO,CAAC;AAEZ,YAAU,MAAM;AACd,QAAI,CAAC,QAAS;AAEd,UAAM,IAAI,OAAO,WAAW,SAAS,GAAG;AACxC,WAAO,MAAM,OAAO,aAAa,CAAC;AAAA,EACpC,GAAG,CAAC,SAAS,OAAO,CAAC;AAErB,YAAU,MAAM;AACd,UAAM,QAAQ,CAAC,MAAqB,EAAE,QAAQ,YAAY,aAAa;AACvE,WAAO,iBAAiB,WAAW,KAAK;AACxC,WAAO,MAAM,OAAO,oBAAoB,WAAW,KAAK;AAAA,EAC1D,GAAG,CAAC,YAAY,CAAC;AAEjB,SACE,iCAEE;AAAA,wBAAC,WAAM,MAAK,4BAA2B,YAAW,WAC/C,yBACH;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,kBAAc;AAAA,QACd,wBAAoB;AAAA,QACnB,GAAI,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;AAAA,QACzC,OAAO,EAAE;AAAA,QACT,SAAS;AAAA;AAAA,IACX;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,kBAAc;AAAA,QACd,uBAAmB;AAAA,QAClB,GAAI,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;AAAA,QACzC,gBAAgB,CAAC,MAAM;AAErB,cAAI,WAAW,EAAE,WAAW,EAAE,cAAe,SAAQ;AAAA,QACvD;AAAA,QACA,OAAO,EAAE;AAAA,QACT,MAAK;AAAA,QACL,cAAW;AAAA,QAEX;AAAA,+BAAC,YAAO,OAAO,EAAE,YACf;AAAA,gCAAC,QAAG,OAAO,EAAE,aAAa,kBAAI;AAAA,YAC9B,oBAAC,YAAO,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE,GAAG,SAAS,cAAc,cAAW,SACpF,8BAAC,aAAU,GACb;AAAA,aACF;AAAA,UAEA,qBAAC,SAAI,OAAO,EAAE,YACX;AAAA,qBAAS,oBAAC,SAAI,OAAO,EAAE,GAAG,EAAE,OAAO,cAAc,GAAG,GAAI,iBAAM;AAAA,YAC9D,UACC,oBAAC,SAAI,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,GAAG,cAAc,GAAG,GAAG,MAAK,UACrE,kBACH;AAAA,YAGD,UACC,oBAAC,OAAE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,GAAG,2BAAQ,IAEvD,QAAQ,IAAI,CAAC,MACX,qBAAC,SAAkB,eAAW,MAAC,OAAO,EAAE,WACtC;AAAA,mCAAC,UAAK,OAAO,EAAE,aAAa,OAAO,EAAE,OAClC;AAAA,kBAAE;AAAA,gBACF,EAAE,UAAU,gBAAgB;AAAA,iBAC/B;AAAA,cAEC,EAAE,WAAW,aAAa,oBAAC,UAAK,OAAO,EAAE,OAAO,qBAAO;AAAA,cAEvD,UACC;AAAA,gBAAC;AAAA;AAAA,kBACC,OAAO,EAAE;AAAA,kBACT,OAAO,EAAE;AAAA,kBACT,UAAU;AAAA,kBACV,UAAU,CAAC,MACT;AAAA,oBAAI,MACF,iBAAiB,EAAE,OAAO,EAAE,OAAO,KAAe;AAAA,kBACpD;AAAA,kBAGD,gBAAM,IAAI,CAAC,MACV,oBAAC,YAAe,OAAO,GACpB,eADU,CAEb,CACD;AAAA;AAAA,cACH,IAEA,oBAAC,UAAK,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,GAAI,YAAE,MAAK;AAAA,cAG3D,WACC;AAAA,gBAAC;AAAA;AAAA,kBACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AAAA,kBAChE,UAAU;AAAA,kBACV,SAAS,MAAM,IAAI,MAAM,wBAAwB,EAAE,KAAK,CAAC;AAAA,kBACzD,cAAY,0BAA0B,EAAE,KAAK;AAAA,kBAC7C,OAAM;AAAA,kBAEN,8BAAC,WAAQ;AAAA;AAAA,cACX;AAAA,cAGD,WACC;AAAA,gBAAC;AAAA;AAAA,kBACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AAAA,kBAChE,UAAU;AAAA,kBACV,SAAS,MAAM,IAAI,MAAM,aAAa,EAAE,KAAK,CAAC;AAAA,kBAC9C,cAAY,UAAU,EAAE,KAAK;AAAA,kBAC7B,OAAM;AAAA,kBAEN,8BAAC,aAAU;AAAA;AAAA,cACb;AAAA,iBAlDM,EAAE,KAoDZ,CACD;AAAA,YAGF,WACC,iCACE;AAAA,kCAAC,OAAE,OAAO,EAAE,cAAc,4BAAc;AAAA,cACxC;AAAA,gBAAC;AAAA;AAAA,kBACC,UAAU,CAAC,MAAM;AACf,sBAAE,eAAe;AACjB,wBAAI,YAAY;AACd,4BAAM,MAAM,MAAM,aAAa,aAAa,UAAU;AACtD,0BAAI,IAAI,QAAS,gBAAe,EAAE;AAClC,6BAAO;AAAA,oBACT,CAAC;AAAA,kBACH;AAAA,kBAEA;AAAA;AAAA,sBAAC;AAAA;AAAA,wBACC,OAAO,EAAE;AAAA,wBACT,MAAK;AAAA,wBACL,aAAY;AAAA,wBACZ,OAAO;AAAA,wBACP,UAAU,CAAC,MAAM,eAAe,EAAE,OAAO,KAAK;AAAA,wBAC9C,UAAQ;AAAA;AAAA,oBACV;AAAA,oBACA,qBAAC,SAAI,OAAO,EAAE,SAAS,QAAQ,KAAK,EAAE,GACpC;AAAA;AAAA,wBAAC;AAAA;AAAA,0BACC,OAAO,EAAE,GAAG,EAAE,QAAQ,MAAM,EAAE;AAAA,0BAC9B,OAAO;AAAA,0BACP,UAAU,CAAC,MAAM,cAAc,EAAE,OAAO,KAAe;AAAA,0BAEtD,gBAAM,IAAI,CAAC,MACV,oBAAC,YAAe,OAAO,GACpB,eADU,CAEb,CACD;AAAA;AAAA,sBACH;AAAA,sBACA,oBAAC,YAAO,OAAO,EAAE,YAAY,MAAK,UAAS,UAAU,SAClD,oBAAU,kBAAa,UAC1B;AAAA,uBACF;AAAA;AAAA;AAAA,cACF;AAAA,cACA,qBAAC,OAAE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,QAAQ,GAAG,WAAW,GAAG,GAAG;AAAA;AAAA,gBAE5C,oBAAC,UAAK,sBAAQ;AAAA,gBAAO;AAAA,gBAAG,oBAAC,UAAK,6BAAe;AAAA,gBAAQ;AAAA,gBAAI;AAAA,iBAG5E;AAAA,eACF;AAAA,aAEJ;AAAA;AAAA;AAAA,IACF;AAAA,KACF;AAEJ;","names":[]}

package/dist/server/access.d.ts

@@ -62,8 +62,9 @@ declare function canEdit(): Promise<boolean>;
  *
  * needsPassword is set by completeAuthRedirectAction the moment an
  * invite/recovery link finishes — it forces chrome on regardless of the
- * edit-mode cookie, since the whole point is to show the set-password prompt
+ * edit-mode cookie, since the whole point is to show the set-password step
  * right away, not require also having ?edit=true or an unsuppressed cookie.
+ * authError (a link that failed) does the same, to explain what happened.
  */
 declare function resolveEditMode(viewer: GRViewer | null, cookieStore: {
     get(name: string): {
@@ -72,6 +73,7 @@ declare function resolveEditMode(viewer: GRViewer | null, cookieStore: {
 }): {
     isEditMode: boolean;
     needsPassword: boolean;
+    authError?: "expired" | "failed";
 };
 
 export { canEdit, isAdmin, isEditor, requireRole, resolveEditMode };

package/dist/server/access.js

@@ -19,9 +19,11 @@ async function canEdit() {
 }
 function resolveEditMode(viewer, cookieStore) {
   const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;
-  const needsPassword = cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === "true";
-  const isEditMode = needsPassword || (editCookie === "false" ? false : editCookie === "true" || viewer !== null);
-  return { isEditMode, needsPassword };
+  const needsPassword = viewer !== null && cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === "true";
+  const rawError = cookieStore.get(GR_COOKIES.AUTH_ERROR)?.value;
+  const authError = rawError === "expired" || rawError === "failed" ? rawError : void 0;
+  const isEditMode = needsPassword || authError !== void 0 || (editCookie === "false" ? false : editCookie === "true" || viewer !== null);
+  return { isEditMode, needsPassword, ...authError ? { authError } : {} };
 }
 export {
   canEdit,

package/dist/server/access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/access.ts"],"sourcesContent":["import { cookies } from \"next/headers\";\nimport { getCachedViewer } from \"./session\";\nimport { GR_COOKIES } from \"../core/defs\";\nimport type { GRRole, GRViewer } from \"../core/types\";\n\n/**\n * Role checks, server-side only.\n *\n * Deliberately NOT in a \"use server\" file: every export of one of those is a\n * callable Server Action endpoint, which is the wrong shape for an\n * authorization helper — it should only ever run inside the server code that\n * calls it.\n *\n * The client's copy of the role (useGRail().role) decides what to *show*; it\n * never decides what is *allowed*. A hidden button is not authorization, so\n * any Server Action behind a custom admin UI must call one of these itself.\n */\n\n/**\n * Returns the signed-in viewer if their role is in `allowed`, otherwise null.\n * The building block for the two helpers below; reach for this directly only\n * when you need the viewer itself (their email, say), not just a yes/no.\n */\nexport async function requireRole(\n  allowed: readonly GRRole[],\n): Promise<GRViewer | null> {\n  const viewer = await getCachedViewer();\n  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;\n  return viewer;\n}\n\n/** True for a signed-in admin of this site — team management, and everything an editor can do. */\nexport async function isAdmin(): Promise<boolean> {\n  return (await requireRole([\"admin\"])) !== null;\n}\n\n/**\n * True for anyone who may edit this site's content: an editor, or an admin\n * (admins can do everything editors can). The check for a custom drawer's\n * Server Action that changes content. Use isAdmin() instead for anything that\n * touches the team.\n */\nexport async function isEditor(): Promise<boolean> {\n  return (await requireRole([\"admin\", \"editor\"])) !== null;\n}\n\n/**\n * True when this viewer may edit AND the site is currently in edit mode — the\n * one check for \"should I show editing UI / do edit-only work right now.\"\n * Admin vs editor doesn't matter; use isAdmin() when it does.\n *\n * For a custom drawer's trigger rendered in a Server Component. In a Client\n * Component, read `canEdit` from useGRail() instead — same answer, same rule.\n * Don't use it as the only authorization on a Server Action: edit mode is a\n * display preference (a cookie the visitor controls), so the action should\n * call isEditor() — this answers \"show it,\" that answers \"allow it.\"\n *\n * Reads cookies, which makes the calling route dynamic — nothing new in\n * practice, since withGuardrail() already does the same in the root layout.\n */\nexport async function canEdit(): Promise<boolean> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return false;\n  return resolveEditMode(viewer, await cookies()).isEditMode;\n}\n\n/**\n * The one definition of \"is the site in edit mode,\" shared by withGuardrail()\n * (which hands it to the client as useGRail().isEditMode) and canEdit() so the\n * two can't drift apart.\n *\n * \"false\" is an explicit, deliberate suppression (the toolbar's exit button,\n * or ?edit=false, while still signed in) and wins outright — it lasts until\n * the next ?edit=true, and ends only the editing session, not the sign-in. Otherwise, a real\n * session is enough on its own — an authenticated editor's chrome persists for\n * as long as that session does, with no separate cookie timer to fall out of\n * sync with it. \"true\" only matters for someone not yet authenticated: a\n * short-lived grace window (see GR_EDIT_MODE_TTL_SECONDS) to actually reach\n * the sign-in form, not a standing invitation — the previous design kept this\n * cookie alive indefinitely once set, which meant a stray copy of it kept\n * showing the sign-in bar to whoever's browser it was sitting in, for as long\n * as that browser stayed open.\n *\n * needsPassword is set by completeAuthRedirectAction the moment an\n * invite/recovery link finishes — it forces chrome on regardless of the\n * edit-mode cookie, since the whole point is to show the set-password prompt\n * right away, not require also having ?edit=true or an unsuppressed cookie.\n */\nexport function resolveEditMode(\n  viewer: GRViewer | null,\n  cookieStore: { get(name: string): { value: string } | undefined },\n): { isEditMode: boolean; needsPassword: boolean } {\n  const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;\n  const needsPassword = cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === \"true\";\n  const isEditMode =\n    needsPassword ||\n    (editCookie === \"false\" ? false : editCookie === \"true\" || viewer !== null);\n  return { isEditMode, needsPassword };\n}\n"],"mappings":"AAAA,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAqB3B,eAAsB,YACpB,SAC0B;AAC1B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAGA,eAAsB,UAA4B;AAChD,SAAQ,MAAM,YAAY,CAAC,OAAO,CAAC,MAAO;AAC5C;AAQA,eAAsB,WAA6B;AACjD,SAAQ,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC,MAAO;AACtD;AAgBA,eAAsB,UAA4B;AAChD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,gBAAgB,QAAQ,MAAM,QAAQ,CAAC,EAAE;AAClD;AAwBO,SAAS,gBACd,QACA,aACiD;AACjD,QAAM,aAAa,YAAY,IAAI,WAAW,SAAS,GAAG;AAC1D,QAAM,gBAAgB,YAAY,IAAI,WAAW,cAAc,GAAG,UAAU;AAC5E,QAAM,aACJ,kBACC,eAAe,UAAU,QAAQ,eAAe,UAAU,WAAW;AACxE,SAAO,EAAE,YAAY,cAAc;AACrC;","names":[]}
+{"version":3,"sources":["../../src/server/access.ts"],"sourcesContent":["import { cookies } from \"next/headers\";\nimport { getCachedViewer } from \"./session\";\nimport { GR_COOKIES } from \"../core/defs\";\nimport type { GRRole, GRViewer } from \"../core/types\";\n\n/**\n * Role checks, server-side only.\n *\n * Deliberately NOT in a \"use server\" file: every export of one of those is a\n * callable Server Action endpoint, which is the wrong shape for an\n * authorization helper — it should only ever run inside the server code that\n * calls it.\n *\n * The client's copy of the role (useGRail().role) decides what to *show*; it\n * never decides what is *allowed*. A hidden button is not authorization, so\n * any Server Action behind a custom admin UI must call one of these itself.\n */\n\n/**\n * Returns the signed-in viewer if their role is in `allowed`, otherwise null.\n * The building block for the two helpers below; reach for this directly only\n * when you need the viewer itself (their email, say), not just a yes/no.\n */\nexport async function requireRole(\n  allowed: readonly GRRole[],\n): Promise<GRViewer | null> {\n  const viewer = await getCachedViewer();\n  if (!viewer || !viewer.role || !allowed.includes(viewer.role)) return null;\n  return viewer;\n}\n\n/** True for a signed-in admin of this site — team management, and everything an editor can do. */\nexport async function isAdmin(): Promise<boolean> {\n  return (await requireRole([\"admin\"])) !== null;\n}\n\n/**\n * True for anyone who may edit this site's content: an editor, or an admin\n * (admins can do everything editors can). The check for a custom drawer's\n * Server Action that changes content. Use isAdmin() instead for anything that\n * touches the team.\n */\nexport async function isEditor(): Promise<boolean> {\n  return (await requireRole([\"admin\", \"editor\"])) !== null;\n}\n\n/**\n * True when this viewer may edit AND the site is currently in edit mode — the\n * one check for \"should I show editing UI / do edit-only work right now.\"\n * Admin vs editor doesn't matter; use isAdmin() when it does.\n *\n * For a custom drawer's trigger rendered in a Server Component. In a Client\n * Component, read `canEdit` from useGRail() instead — same answer, same rule.\n * Don't use it as the only authorization on a Server Action: edit mode is a\n * display preference (a cookie the visitor controls), so the action should\n * call isEditor() — this answers \"show it,\" that answers \"allow it.\"\n *\n * Reads cookies, which makes the calling route dynamic — nothing new in\n * practice, since withGuardrail() already does the same in the root layout.\n */\nexport async function canEdit(): Promise<boolean> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return false;\n  return resolveEditMode(viewer, await cookies()).isEditMode;\n}\n\n/**\n * The one definition of \"is the site in edit mode,\" shared by withGuardrail()\n * (which hands it to the client as useGRail().isEditMode) and canEdit() so the\n * two can't drift apart.\n *\n * \"false\" is an explicit, deliberate suppression (the toolbar's exit button,\n * or ?edit=false, while still signed in) and wins outright — it lasts until\n * the next ?edit=true, and ends only the editing session, not the sign-in. Otherwise, a real\n * session is enough on its own — an authenticated editor's chrome persists for\n * as long as that session does, with no separate cookie timer to fall out of\n * sync with it. \"true\" only matters for someone not yet authenticated: a\n * short-lived grace window (see GR_EDIT_MODE_TTL_SECONDS) to actually reach\n * the sign-in form, not a standing invitation — the previous design kept this\n * cookie alive indefinitely once set, which meant a stray copy of it kept\n * showing the sign-in bar to whoever's browser it was sitting in, for as long\n * as that browser stayed open.\n *\n * needsPassword is set by completeAuthRedirectAction the moment an\n * invite/recovery link finishes — it forces chrome on regardless of the\n * edit-mode cookie, since the whole point is to show the set-password step\n * right away, not require also having ?edit=true or an unsuppressed cookie.\n * authError (a link that failed) does the same, to explain what happened.\n */\nexport function resolveEditMode(\n  viewer: GRViewer | null,\n  cookieStore: { get(name: string): { value: string } | undefined },\n): { isEditMode: boolean; needsPassword: boolean; authError?: \"expired\" | \"failed\" } {\n  const editCookie = cookieStore.get(GR_COOKIES.EDIT_MODE)?.value;\n  // Only means anything with a session to set a password on. A leftover flag —\n  // from a link whose session has since been signed out or expired — must not\n  // be able to force the chrome on for someone nobody is signed in as, which no\n  // \"off\" setting could undo.\n  const needsPassword =\n    viewer !== null && cookieStore.get(GR_COOKIES.NEEDS_PASSWORD)?.value === \"true\";\n  const rawError = cookieStore.get(GR_COOKIES.AUTH_ERROR)?.value;\n  const authError = rawError === \"expired\" || rawError === \"failed\" ? rawError : undefined;\n  // A failed link forces the chrome on for the same reason a pending password\n  // does: the whole point is to tell the person right now, even if they arrived\n  // with no ?edit=true and no session.\n  const isEditMode =\n    needsPassword ||\n    authError !== undefined ||\n    (editCookie === \"false\" ? false : editCookie === \"true\" || viewer !== null);\n  return { isEditMode, needsPassword, ...(authError ? { authError } : {}) };\n}\n"],"mappings":"AAAA,SAAS,eAAe;AACxB,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAqB3B,eAAsB,YACpB,SAC0B;AAC1B,QAAM,SAAS,MAAM,gBAAgB;AACrC,MAAI,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAGA,eAAsB,UAA4B;AAChD,SAAQ,MAAM,YAAY,CAAC,OAAO,CAAC,MAAO;AAC5C;AAQA,eAAsB,WAA6B;AACjD,SAAQ,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC,MAAO;AACtD;AAgBA,eAAsB,UAA4B;AAChD,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,gBAAgB,QAAQ,MAAM,QAAQ,CAAC,EAAE;AAClD;AAyBO,SAAS,gBACd,QACA,aACmF;AACnF,QAAM,aAAa,YAAY,IAAI,WAAW,SAAS,GAAG;AAK1D,QAAM,gBACJ,WAAW,QAAQ,YAAY,IAAI,WAAW,cAAc,GAAG,UAAU;AAC3E,QAAM,WAAW,YAAY,IAAI,WAAW,UAAU,GAAG;AACzD,QAAM,YAAY,aAAa,aAAa,aAAa,WAAW,WAAW;AAI/E,QAAM,aACJ,iBACA,cAAc,WACb,eAAe,UAAU,QAAQ,eAAe,UAAU,WAAW;AACxE,SAAO,EAAE,YAAY,eAAe,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC,EAAG;AAC1E;","names":[]}

package/dist/server/actions.d.ts

@@ -2,9 +2,11 @@ import { GRRole, GRAsset, GRMember, OverrideValue, SetPasswordState, ActionState
 import { GRUploadTarget, AuthRedirectParams } from '../core/adapter-types.js';
 import 'react';
 
+/** `notice` is for a success the admin should still read, e.g. "no email was sent because...". */
 type Result = {
     success: boolean;
     error?: string;
+    notice?: string;
 };
 declare function saveOverride(row: OverrideRow): Promise<Result>;
 /**
@@ -46,13 +48,26 @@ declare function listTeam(): Promise<GRMember[]>;
 declare function inviteMember(email: string, role: GRRole): Promise<Result>;
 declare function updateMemberRole(email: string, role: GRRole): Promise<Result>;
 declare function removeMember(email: string): Promise<Result>;
+/**
+ * "Forgot password?" from the sign-in bar. Called with no session, so it says
+ * the same thing whether or not the address belongs to anyone: a member gets an
+ * email, a stranger gets nothing, and neither can tell which happened from the
+ * response or how long it took. Only a malformed address is rejected, since
+ * that says nothing about anyone.
+ */
+declare function forgotPasswordAction(email: string): Promise<Result>;
+/**
+ * An admin sending a password reset to someone on the team, from the Team
+ * drawer. Unlike the self-service request this reports what happened — an admin
+ * is allowed to know, and needs to when it didn't work.
+ */
+declare function sendPasswordResetAction(email: string): Promise<Result>;
 declare function loginAction(_prev: ActionState, formData: FormData): Promise<ActionState>;
 declare function logoutAction(): Promise<{
     success: boolean;
 }>;
 /**
- * Completes a session that arrived via an invite, magic-link, or
- * password-recovery redirect. Called by AuthRedirectSync (react/), the
+ * Completes a session that arrived via an invite or password-recovery link. Called by AuthRedirectSync (react/), the
  * generic client component that notices this kind of link and hands off
  * whatever it found in the URL — the actual token exchange is entirely the
  * auth adapter's job (see GRAuthAdapter.completeAuthRedirect); core only
@@ -74,9 +89,15 @@ declare function completeAuthRedirectAction(params: AuthRedirectParams): Promise
  * resolving them, which already happens independently of this.
  */
 declare function setPasswordAction(_prev: SetPasswordState, formData: FormData): Promise<SetPasswordState>;
-/** Dismisses the set-password prompt without setting one — see Admin.tsx. */
+/**
+ * Dismisses the set-password step without setting a password.
+ *
+ * @deprecated Guardrail's own UI no longer offers this: passwords are the only
+ * way back in, so the step can't be skipped. Kept so an app's own UI built on
+ * it keeps working.
+ */
 declare function skipSetPasswordAction(): Promise<{
     success: boolean;
 }>;
 
-export { completeAuthRedirectAction, createAssetUpload, inviteMember, listAssets, listTeam, loginAction, logoutAction, removeMember, saveOverride, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole };
+export { completeAuthRedirectAction, createAssetUpload, forgotPasswordAction, inviteMember, listAssets, listTeam, loginAction, logoutAction, removeMember, saveOverride, sendPasswordResetAction, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole };

package/dist/server/actions.js

@@ -6,13 +6,18 @@ import {
   getDB,
   getInviteHandler,
   getMembers,
+  getPasswordResetHandler,
   getStorage,
   resolveSiteId
 } from "../core/config";
 import { getCachedViewer } from "./session";
 import { requireRole } from "./access";
 import { rethrowIfBailout } from "../core/bailout";
-import { GR_COOKIES, GR_NEEDS_PASSWORD_TTL_SECONDS } from "../core/defs";
+import {
+  GR_AUTH_ERROR_TTL_SECONDS,
+  GR_COOKIES,
+  GR_NEEDS_PASSWORD_TTL_SECONDS
+} from "../core/defs";
 const DENIED = { success: false, error: "Unauthorized." };
 async function saveOverride(row) {
   const viewer = await requireRole(["admin", "editor"]);
@@ -110,29 +115,43 @@ async function inviteMember(email, role) {
     if (!res.success) return res;
   }
   const auth = getAuth();
-  if (auth.inviteUser) {
-    const sent = await auth.inviteUser(normalized, {
-      redirectTo: `${await requestOrigin()}/?edit=true`
-    });
+  const onInvite = getInviteHandler();
+  const origin = await requestOrigin();
+  const made = auth.createInviteLink ? await auth.createInviteLink(normalized, { origin }) : null;
+  if (made && !made.success) {
+    revalidatePath("/", "layout");
+    return {
+      success: false,
+      error: `Invite saved, but the sign-in link couldn't be created: ${made.error}`
+    };
+  }
+  if (!onInvite) {
     revalidatePath("/", "layout");
-    return sent.success ? { success: true } : {
+    return {
       success: false,
-      error: `Invite saved, but the email failed: ${sent.error}`
+      error: "Invite saved, but this site has nothing set up to email it. Add resendEmails() (or your own onInvite) to withGuardrail() \u2014 see the README."
     };
   }
   try {
-    await getInviteHandler()?.({
+    await onInvite({
       email: normalized,
       role: existing?.role ?? role,
       siteId,
-      invitedBy: viewer.email ?? viewer.userId
+      invitedBy: viewer.email ?? viewer.userId,
+      ...made ? { link: made.link, isNewUser: made.isNewUser } : {}
     });
   } catch (e) {
     console.error("Guardrail: onInvite handler threw", e);
+    revalidatePath("/", "layout");
+    return {
+      success: false,
+      error: `Invite saved, but the email failed: ${e instanceof Error ? e.message : "unknown error"}`
+    };
   }
   revalidatePath("/", "layout");
-  return { success: true };
+  return made && !made.isNewUser ? { success: true, notice: ALREADY_HAS_ACCOUNT(normalized) } : { success: true };
 }
+const ALREADY_HAS_ACCOUNT = (email) => `${email} already has an account, so they were told they've been added rather than sent a link \u2014 they sign in with their existing password.`;
 async function updateMemberRole(email, role) {
   const viewer = await requireRole(["admin"]);
   if (!viewer) return DENIED;
@@ -167,6 +186,74 @@ async function removeMember(email) {
   if (res.success) revalidatePath("/", "layout");
   return res;
 }
+const RESET_COOLDOWN_MS = 6e4;
+const lastResetAt = /* @__PURE__ */ new Map();
+const RESET_MIN_DURATION_MS = 600;
+const EMAIL_PATTERN = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+async function dispatchPasswordReset(email, requestedBy) {
+  const auth = getAuth();
+  const handler = getPasswordResetHandler();
+  if (!auth.createPasswordResetLink) {
+    return {
+      success: false,
+      error: "this site's auth setup can't create reset links \u2014 give the Supabase adapter a serviceRoleKey."
+    };
+  }
+  if (!handler) {
+    return {
+      success: false,
+      error: "this site has no onPasswordReset handler \u2014 add resendEmails() (or your own) to withGuardrail()."
+    };
+  }
+  const made = await auth.createPasswordResetLink(email, { origin: await requestOrigin() });
+  if (!made.success) return { success: false, error: made.error };
+  try {
+    await handler({ email, siteId: await resolveSiteId(), link: made.link, requestedBy });
+    return { success: true };
+  } catch (e) {
+    console.error("Guardrail: onPasswordReset handler threw", e);
+    return { success: false, error: e instanceof Error ? e.message : "unknown error" };
+  }
+}
+async function forgotPasswordAction(email) {
+  const started = Date.now();
+  const normalized = String(email ?? "").toLowerCase().trim();
+  if (!EMAIL_PATTERN.test(normalized)) {
+    return { success: false, error: "Enter a valid email address." };
+  }
+  try {
+    const siteId = await resolveSiteId();
+    const key = `${siteId}:${normalized}`;
+    const last = lastResetAt.get(key);
+    if (!last || started - last >= RESET_COOLDOWN_MS) {
+      lastResetAt.set(key, started);
+      if (lastResetAt.size > 500) {
+        for (const [k, t] of lastResetAt) if (started - t >= RESET_COOLDOWN_MS) lastResetAt.delete(k);
+      }
+      const members = getMembers();
+      const known = members.emailHasAccess ? await members.emailHasAccess(siteId, normalized) : true;
+      if (known) {
+        const res = await dispatchPasswordReset(normalized, "self");
+        if (!res.success) console.error("Guardrail: password reset failed:", res.error);
+      }
+    }
+  } catch (e) {
+    rethrowIfBailout(e);
+    console.error("Guardrail: password reset failed", e);
+  }
+  const wait = RESET_MIN_DURATION_MS - (Date.now() - started);
+  if (wait > 0) await new Promise((resolve) => setTimeout(resolve, wait));
+  return { success: true };
+}
+async function sendPasswordResetAction(email) {
+  const viewer = await requireRole(["admin"]);
+  if (!viewer) return DENIED;
+  const normalized = String(email ?? "").toLowerCase().trim();
+  const target = await getMembers().getMember(await resolveSiteId(), { email: normalized });
+  if (!target) return { success: false, error: "No such member." };
+  const res = await dispatchPasswordReset(normalized, viewer.email ?? viewer.userId);
+  return res.success ? { success: true, notice: `Password reset email sent to ${normalized}.` } : { success: false, error: `The reset email couldn't be sent: ${res.error}` };
+}
 async function requestOrigin() {
   const h = await headers();
   const origin = h.get("origin");
@@ -210,6 +297,8 @@ async function logoutAction() {
   await auth.logout();
   const cookieStore = await cookies();
   cookieStore.delete(GR_COOKIES.EDIT_MODE);
+  cookieStore.delete(GR_COOKIES.NEEDS_PASSWORD);
+  cookieStore.delete(GR_COOKIES.AUTH_ERROR);
   revalidatePath("/", "layout");
   return { success: true };
 }
@@ -217,15 +306,24 @@ async function completeAuthRedirectAction(params) {
   const auth = getAuth();
   if (!auth.completeAuthRedirect) return { success: false };
   const res = await auth.completeAuthRedirect(params);
+  const cookieStore = await cookies();
   if (res.success) {
+    cookieStore.delete(GR_COOKIES.AUTH_ERROR);
     if (res.needsPassword) {
-      const cookieStore = await cookies();
       cookieStore.set(GR_COOKIES.NEEDS_PASSWORD, "true", {
         path: "/",
         maxAge: GR_NEEDS_PASSWORD_TTL_SECONDS
       });
     }
     revalidatePath("/", "layout");
+  } else {
+    console.error("Guardrail: couldn't complete an emailed link:", res.error);
+    cookieStore.set(
+      GR_COOKIES.AUTH_ERROR,
+      /expired|invalid|already|used|not found/i.test(res.error ?? "") ? "expired" : "failed",
+      { path: "/", maxAge: GR_AUTH_ERROR_TTL_SECONDS }
+    );
+    revalidatePath("/", "layout");
   }
   return res;
 }
@@ -237,6 +335,13 @@ async function setPasswordAction(_prev, formData) {
     return { success: false, error: "This site's auth provider does not support setting a password." };
   }
   const password = String(formData.get("password") ?? "");
+  const confirm = formData.get("confirm");
+  if (password.length < 8) {
+    return { success: false, error: "Use at least 8 characters." };
+  }
+  if (confirm !== null && String(confirm) !== password) {
+    return { success: false, error: "The two passwords don't match." };
+  }
   const res = await auth.setPassword(password);
   if (res.success) {
     const cookieStore = await cookies();
@@ -254,6 +359,7 @@ async function skipSetPasswordAction() {
 export {
   completeAuthRedirectAction,
   createAssetUpload,
+  forgotPasswordAction,
   inviteMember,
   listAssets,
   listTeam,
@@ -261,6 +367,7 @@ export {
   logoutAction,
   removeMember,
   saveOverride,
+  sendPasswordResetAction,
   setFieldValue,
   setPasswordAction,
   skipSetPasswordAction,