@guard-rail/core 0.8.0 → 0.9.0

package/dist/core/adapter-types.d.ts

@@ -76,30 +76,21 @@ interface GRAuthAdapter {
      */
     signInUrl?: string;
     /**
-     * Ask the provider to create an account for an invited address and contact
-     * them. Optional — Guardrail falls back to the onInvite callback when the
-     * provider cannot do it.
+     * Create the account and return a one-time link that lets the invitee choose
+     * a password, without sending anything — Guardrail hands it to the app's
+     * onInvite handler to email. Optional: an adapter that can't mint links
+     * leaves delivery entirely to onInvite, which then gets no `link`.
      *
      * Account creation stays the identity provider's job. Guardrail records who
      * is allowed to edit; it never owns credentials.
-     */
-    inviteUser?: (email: string, options?: {
-        redirectTo?: string;
-    }) => Promise<{
-        success: boolean;
-        error?: string;
-    }>;
-    /**
-     * Create the account and return a one-time sign-in link, without sending
-     * anything — for an app that delivers its own invitation email (see
-     * onInvite). Optional, and only worth implementing when the provider can
-     * mint a link server-side; Guardrail uses it only when the app also
-     * provides onInvite, and otherwise falls back to inviteUser.
      *
      * `origin` is the site's own origin, so the link points back at the site
-     * (where AuthRedirectSync completes it) rather than at the provider.
-     * `isNewUser` says whether this created an account or the address already
-     * had one — worth a different email ("set up" vs "sign in").
+     * (where AuthRedirectSync completes it) rather than at the provider — which
+     * is why no redirect allowlist is involved. `isNewUser` says whether this
+     * created an account or the address already had one. A new account's link
+     * lets them choose a password. An existing account's "link" is just the
+     * site's address, with no token: they already have a password, and an emailed
+     * link must not be a way to sign in.
      */
     createInviteLink?: (email: string, options: {
         origin: string;
@@ -111,6 +102,20 @@ interface GRAuthAdapter {
         success: false;
         error: string;
     }>;
+    /**
+     * Mint a one-time "set a new password" link without sending anything;
+     * Guardrail hands it to onPasswordReset to email. Same shape and reasoning as
+     * createInviteLink. Without it, password resets can't be sent.
+     */
+    createPasswordResetLink?: (email: string, options: {
+        origin: string;
+    }) => Promise<{
+        success: true;
+        link: string;
+    } | {
+        success: false;
+        error: string;
+    }>;
     /**
      * Return the current verified session, or null.
      *
@@ -193,6 +198,16 @@ interface GRMembershipAdapter {
         success: boolean;
         error?: string;
     }>;
+    /**
+     * Whether this address is a member of the site — checked with no session,
+     * for the "forgot password" request that arrives before anyone is signed in.
+     * Optional because it needs privileged access to the membership store, which
+     * a normal anonymous session doesn't have; without it, Guardrail can't tell
+     * a member from anyone else and a reset goes to any address that asks, so an
+     * adapter that offers createPasswordResetLink should offer this too. Used
+     * only to decide whether to send, never to answer the requester.
+     */
+    emailHasAccess?: (siteId: string, email: string) => Promise<boolean>;
     /**
      * Bind a pending invitation to the signed-in user.
      *
@@ -279,6 +294,14 @@ interface GRInviteEvent {
     /** Whether the invite created an account (true) or the address already had one. Set alongside `link`. */
     isNewUser?: boolean;
 }
+interface GRPasswordResetEvent {
+    email: string;
+    siteId: string;
+    /** A one-time link that lets the person choose a new password. */
+    link: string;
+    /** "self" for someone who asked from the sign-in bar; otherwise the admin who sent it. */
+    requestedBy: string;
+}
 interface GRConfig {
     db: GRDBAdapter;
     auth: GRAuthAdapter;
@@ -289,17 +312,26 @@ interface GRConfig {
     repeaters?: GRRepeaterAdapter;
     siteId: string | (() => string | Promise<string>);
     /**
-     * Called when an admin invites someone. Guardrail records the pending
-     * membership; delivering the invitation is the app's job, using whatever
-     * mail provider it already has. In-process by design — a library running
-     * inside the developer's server has no need for webhooks.
+     * How an invitation gets delivered. Guardrail records the pending membership
+     * and — when the auth adapter can (createInviteLink) — creates the account and
+     * a one-time link; this handler emails it, with whatever mail provider the app
+     * already has. `resendEmails()` is a ready-made one. In-process by design — a
+     * library running inside the developer's server has no need for webhooks.
      *
-     * When the auth adapter can create sign-in links (createInviteLink), this is
-     * also how an app owns the email itself: the event carries `link`, and
-     * `resendInvite()` is a ready-made handler. Throwing reports the failure to
-     * the admin who sent the invite.
+     * Required for invites to reach anyone: without it the admin is told the
+     * invite was saved but nothing sent it. Throwing reports the failure to the
+     * admin who sent the invite.
      */
     onInvite?: (event: GRInviteEvent) => void | Promise<void>;
+    /**
+     * Delivers a password-reset email — for "Forgot password?" on the sign-in
+     * bar, and for the reset an admin sends from the Team drawer. Needs an auth
+     * adapter that can mint the link (createPasswordResetLink); the event carries
+     * it. `resendEmails()` provides this too. Without it, resets can't be sent.
+     * Throwing is reported to the admin who sent it; a self-service request always
+     * looks successful to the requester, so a missing account can't be probed.
+     */
+    onPasswordReset?: (event: GRPasswordResetEvent) => void | Promise<void>;
     /**
      * Extra content rendered in the toolbar pill, next to Team and Log out.
      * Plain JSX, not a component reference or a structured item schema — the
@@ -321,4 +353,4 @@ interface GRConfig {
     prefetch?: false | GRPrefetch;
 }
 
-export type { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget };
+export type { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget };

package/dist/core/config.d.ts

@@ -28,6 +28,7 @@ declare function getPrefetch(): {
     limit: number;
 } | null;
 declare function getInviteHandler(): GRConfig["onInvite"];
+declare function getPasswordResetHandler(): GRConfig["onPasswordReset"];
 declare function resolveSiteId(): Promise<string>;
 
-export { DEFAULT_PREFETCH_LIMIT, configureGuardrail, getAuth, getDB, getInviteHandler, getMembers, getPrefetch, getRepeaters, getStorage, resolveSiteId };
+export { DEFAULT_PREFETCH_LIMIT, configureGuardrail, getAuth, getDB, getInviteHandler, getMembers, getPasswordResetHandler, getPrefetch, getRepeaters, getStorage, resolveSiteId };

package/dist/core/config.js

@@ -38,6 +38,9 @@ function getPrefetch() {
 function getInviteHandler() {
   return _config?.onInvite;
 }
+function getPasswordResetHandler() {
+  return _config?.onPasswordReset;
+}
 async function resolveSiteId() {
   const sid = _config?.siteId ?? "default";
   return typeof sid === "function" ? await sid() : sid || "default";
@@ -49,6 +52,7 @@ export {
   getDB,
   getInviteHandler,
   getMembers,
+  getPasswordResetHandler,
   getPrefetch,
   getRepeaters,
   getStorage,

package/dist/core/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/config.ts"],"sourcesContent":["import type {\n  GRConfig,\n  GRAuthAdapter,\n  GRDBAdapter,\n  GRMembershipAdapter,\n  GRRepeaterAdapter,\n  GRStorageAdapter,\n} from \"./adapter-types\";\n\nlet _config: GRConfig | null = null;\n\n/**\n * Registers the adapters Guardrail should use.\n *\n * Idempotent, and re-applied on every render by withGuardrail: Next.js does not\n * guarantee one shared module instance across the SSR graph, the server-action\n * graph, and the workers used for static generation, so config registered once\n * at startup is simply absent in some of them.\n *\n * Core has no knowledge of any particular backend — there is no default and no\n * fallback. An app names its adapters explicitly or Guardrail refuses to run.\n */\nexport function configureGuardrail(config: GRConfig): void {\n  _config = config;\n}\n\nfunction required<K extends keyof GRConfig>(key: K): GRConfig[K] {\n  const value = _config?.[key];\n  if (!value) {\n    throw new Error(\n      `Guardrail: no ${String(key)} adapter configured. Pass one to ` +\n        `withGuardrail(Layout, { db, auth, members }).`,\n    );\n  }\n  return value;\n}\n\nexport function getDB(): GRDBAdapter {\n  return required(\"db\") as GRDBAdapter;\n}\n\nexport function getAuth(): GRAuthAdapter {\n  return required(\"auth\") as GRAuthAdapter;\n}\n\nexport function getMembers(): GRMembershipAdapter {\n  return required(\"members\") as GRMembershipAdapter;\n}\n\n/** Optional — sites without editable images need no storage. */\nexport function getStorage(): GRStorageAdapter | undefined {\n  return _config?.storage;\n}\n\n/** Throws with a clear message if no page on this site uses <GRepeater>. */\nexport function getRepeaters(): GRRepeaterAdapter {\n  return required(\"repeaters\") as GRRepeaterAdapter;\n}\n\nexport const DEFAULT_PREFETCH_LIMIT = 500;\n\n/** Normalized preload settings, or null when preloading is off. */\nexport function getPrefetch(): { prefix?: string[]; limit: number } | null {\n  const p = _config?.prefetch;\n  if (p === false) return null;\n  return {\n    ...(p?.prefix?.length ? { prefix: p.prefix } : {}),\n    limit: p?.limit ?? DEFAULT_PREFETCH_LIMIT,\n  };\n}\n\nexport function getInviteHandler(): GRConfig[\"onInvite\"] {\n  return _config?.onInvite;\n}\n\nexport async function resolveSiteId(): Promise<string> {\n  const sid = _config?.siteId ?? \"default\";\n  return typeof sid === \"function\" ? await sid() : sid || \"default\";\n}\n"],"mappings":"AASA,IAAI,UAA2B;AAaxB,SAAS,mBAAmB,QAAwB;AACzD,YAAU;AACZ;AAEA,SAAS,SAAmC,KAAqB;AAC/D,QAAM,QAAQ,UAAU,GAAG;AAC3B,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,iBAAiB,OAAO,GAAG,CAAC;AAAA,IAE9B;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,QAAqB;AACnC,SAAO,SAAS,IAAI;AACtB;AAEO,SAAS,UAAyB;AACvC,SAAO,SAAS,MAAM;AACxB;AAEO,SAAS,aAAkC;AAChD,SAAO,SAAS,SAAS;AAC3B;AAGO,SAAS,aAA2C;AACzD,SAAO,SAAS;AAClB;AAGO,SAAS,eAAkC;AAChD,SAAO,SAAS,WAAW;AAC7B;AAEO,MAAM,yBAAyB;AAG/B,SAAS,cAA2D;AACzE,QAAM,IAAI,SAAS;AACnB,MAAI,MAAM,MAAO,QAAO;AACxB,SAAO;AAAA,IACL,GAAI,GAAG,QAAQ,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,IAChD,OAAO,GAAG,SAAS;AAAA,EACrB;AACF;AAEO,SAAS,mBAAyC;AACvD,SAAO,SAAS;AAClB;AAEA,eAAsB,gBAAiC;AACrD,QAAM,MAAM,SAAS,UAAU;AAC/B,SAAO,OAAO,QAAQ,aAAa,MAAM,IAAI,IAAI,OAAO;AAC1D;","names":[]}
+{"version":3,"sources":["../../src/core/config.ts"],"sourcesContent":["import type {\n  GRConfig,\n  GRAuthAdapter,\n  GRDBAdapter,\n  GRMembershipAdapter,\n  GRRepeaterAdapter,\n  GRStorageAdapter,\n} from \"./adapter-types\";\n\nlet _config: GRConfig | null = null;\n\n/**\n * Registers the adapters Guardrail should use.\n *\n * Idempotent, and re-applied on every render by withGuardrail: Next.js does not\n * guarantee one shared module instance across the SSR graph, the server-action\n * graph, and the workers used for static generation, so config registered once\n * at startup is simply absent in some of them.\n *\n * Core has no knowledge of any particular backend — there is no default and no\n * fallback. An app names its adapters explicitly or Guardrail refuses to run.\n */\nexport function configureGuardrail(config: GRConfig): void {\n  _config = config;\n}\n\nfunction required<K extends keyof GRConfig>(key: K): GRConfig[K] {\n  const value = _config?.[key];\n  if (!value) {\n    throw new Error(\n      `Guardrail: no ${String(key)} adapter configured. Pass one to ` +\n        `withGuardrail(Layout, { db, auth, members }).`,\n    );\n  }\n  return value;\n}\n\nexport function getDB(): GRDBAdapter {\n  return required(\"db\") as GRDBAdapter;\n}\n\nexport function getAuth(): GRAuthAdapter {\n  return required(\"auth\") as GRAuthAdapter;\n}\n\nexport function getMembers(): GRMembershipAdapter {\n  return required(\"members\") as GRMembershipAdapter;\n}\n\n/** Optional — sites without editable images need no storage. */\nexport function getStorage(): GRStorageAdapter | undefined {\n  return _config?.storage;\n}\n\n/** Throws with a clear message if no page on this site uses <GRepeater>. */\nexport function getRepeaters(): GRRepeaterAdapter {\n  return required(\"repeaters\") as GRRepeaterAdapter;\n}\n\nexport const DEFAULT_PREFETCH_LIMIT = 500;\n\n/** Normalized preload settings, or null when preloading is off. */\nexport function getPrefetch(): { prefix?: string[]; limit: number } | null {\n  const p = _config?.prefetch;\n  if (p === false) return null;\n  return {\n    ...(p?.prefix?.length ? { prefix: p.prefix } : {}),\n    limit: p?.limit ?? DEFAULT_PREFETCH_LIMIT,\n  };\n}\n\nexport function getInviteHandler(): GRConfig[\"onInvite\"] {\n  return _config?.onInvite;\n}\n\nexport function getPasswordResetHandler(): GRConfig[\"onPasswordReset\"] {\n  return _config?.onPasswordReset;\n}\n\nexport async function resolveSiteId(): Promise<string> {\n  const sid = _config?.siteId ?? \"default\";\n  return typeof sid === \"function\" ? await sid() : sid || \"default\";\n}\n"],"mappings":"AASA,IAAI,UAA2B;AAaxB,SAAS,mBAAmB,QAAwB;AACzD,YAAU;AACZ;AAEA,SAAS,SAAmC,KAAqB;AAC/D,QAAM,QAAQ,UAAU,GAAG;AAC3B,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,iBAAiB,OAAO,GAAG,CAAC;AAAA,IAE9B;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,QAAqB;AACnC,SAAO,SAAS,IAAI;AACtB;AAEO,SAAS,UAAyB;AACvC,SAAO,SAAS,MAAM;AACxB;AAEO,SAAS,aAAkC;AAChD,SAAO,SAAS,SAAS;AAC3B;AAGO,SAAS,aAA2C;AACzD,SAAO,SAAS;AAClB;AAGO,SAAS,eAAkC;AAChD,SAAO,SAAS,WAAW;AAC7B;AAEO,MAAM,yBAAyB;AAG/B,SAAS,cAA2D;AACzE,QAAM,IAAI,SAAS;AACnB,MAAI,MAAM,MAAO,QAAO;AACxB,SAAO;AAAA,IACL,GAAI,GAAG,QAAQ,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,IAChD,OAAO,GAAG,SAAS;AAAA,EACrB;AACF;AAEO,SAAS,mBAAyC;AACvD,SAAO,SAAS;AAClB;AAEO,SAAS,0BAAuD;AACrE,SAAO,SAAS;AAClB;AAEA,eAAsB,gBAAiC;AACrD,QAAM,MAAM,SAAS,UAAU;AAC/B,SAAO,OAAO,QAAQ,aAAa,MAAM,IAAI,IAAI,OAAO;AAC1D;","names":[]}

package/dist/core/defs.d.ts

@@ -24,7 +24,17 @@ declare const GR_COOKIES: {
      * they explicitly skip.
      */
     readonly NEEDS_PASSWORD: "gr_needs_password";
+    /**
+     * Set server-side when an emailed link fails to complete — expired, already
+     * used, or malformed — so the next render can say so instead of leaving the
+     * person on a plain page wondering why nothing happened. Holds a short code
+     * ("expired" | "failed"), never the provider's own message. Short-lived and
+     * cleared when the message is dismissed.
+     */
+    readonly AUTH_ERROR: "gr_auth_error";
 };
+/** How long a "that link didn't work" message waits to be seen. */
+declare const GR_AUTH_ERROR_TTL_SECONDS: number;
 /**
  * How long the edit-mode cookie's "true"/"false" values last before
  * reverting to the session-derived default. Short on purpose: it only ever
@@ -72,4 +82,4 @@ declare const GR_TABLE = "gr_content";
 declare const GR_MEMBERS_TABLE = "gr_members";
 declare const GR_REPEATER_TABLE = "gr_repeater_items";
 
-export { GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS, GR_EDIT_MODE_TTL_SECONDS, GR_MEMBERS_TABLE, GR_NEEDS_PASSWORD_TTL_SECONDS, GR_REPEATER_TABLE, GR_SCHEMA, GR_TABLE };
+export { GR_AUTH_ERROR_TTL_SECONDS, GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS, GR_EDIT_MODE_TTL_SECONDS, GR_MEMBERS_TABLE, GR_NEEDS_PASSWORD_TTL_SECONDS, GR_REPEATER_TABLE, GR_SCHEMA, GR_TABLE };

package/dist/core/defs.js

@@ -23,8 +23,17 @@ const GR_COOKIES = {
    * instead of showing the normal toolbar. Cleared once they do, or once
    * they explicitly skip.
    */
-  NEEDS_PASSWORD: "gr_needs_password"
+  NEEDS_PASSWORD: "gr_needs_password",
+  /**
+   * Set server-side when an emailed link fails to complete — expired, already
+   * used, or malformed — so the next render can say so instead of leaving the
+   * person on a plain page wondering why nothing happened. Holds a short code
+   * ("expired" | "failed"), never the provider's own message. Short-lived and
+   * cleared when the message is dismissed.
+   */
+  AUTH_ERROR: "gr_auth_error"
 };
+const GR_AUTH_ERROR_TTL_SECONDS = 2 * 60;
 const GR_EDIT_MODE_TTL_SECONDS = 10 * 60;
 const GR_EDIT_MODE_OFF_TTL_SECONDS = 400 * 24 * 60 * 60;
 const GR_NEEDS_PASSWORD_TTL_SECONDS = 30 * 60;
@@ -33,6 +42,7 @@ const GR_TABLE = "gr_content";
 const GR_MEMBERS_TABLE = "gr_members";
 const GR_REPEATER_TABLE = "gr_repeater_items";
 export {
+  GR_AUTH_ERROR_TTL_SECONDS,
   GR_COOKIES,
   GR_EDIT_MODE_OFF_TTL_SECONDS,
   GR_EDIT_MODE_TTL_SECONDS,

package/dist/core/defs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/defs.ts"],"sourcesContent":["export const GR_COOKIES = {\n  /**\n   * Signals intent to edit. Carries no authority on its own — every write\n   * still goes through a real, server-verified role check, independent of\n   * this — but it does decide whether the admin chrome (the sign-in bar, or\n   * the toolbar) renders at all, so it is not harmless either: a stale copy\n   * of it is a real, if low-stakes, exposure (\"there's a CMS here\") to\n   * whoever's browser it's sitting in next, not just its original visitor.\n   *\n   * Values: \"true\" (show chrome — the short-lived grace window below, for\n   * someone not yet authenticated to reach the sign-in form), \"false\"\n   * (explicitly suppressed, e.g. ?edit=false previewing without chrome while\n   * still signed in), or absent. Absent defers entirely to whether a real\n   * session exists (see withGuardrail) — an authenticated editor's chrome\n   * persists for as long as their actual session does, with no separate\n   * timer of its own to fall out of sync with it.\n   */\n  EDIT_MODE: \"gr_edit_mode\",\n  /**\n   * Set server-side the moment a redirect-carried session (an invite or\n   * password-recovery link) completes, so the next render — which has no\n   * other way to know that just happened — prompts to set a password\n   * instead of showing the normal toolbar. Cleared once they do, or once\n   * they explicitly skip.\n   */\n  NEEDS_PASSWORD: \"gr_needs_password\",\n} as const;\n\n/**\n * How long the edit-mode cookie's \"true\"/\"false\" values last before\n * reverting to the session-derived default. Short on purpose: it only ever\n * needs to outlive the handful of clicks between landing on ?edit=true and\n * actually typing a password (or, for ?edit=false, a quick chrome-free\n * preview) — not a whole working session, which persists through real auth\n * instead. Bounds how long a stray copy of this cookie can show anything to\n * whoever's browser it's left in, self-healing without needing an explicit\n * logout.\n */\nexport const GR_EDIT_MODE_TTL_SECONDS = 10 * 60;\n\n/**\n * How long an explicit \"off\" (the toolbar's exit button, ?edit=false, or the\n * sign-in bar's dismiss) is remembered. Long, unlike \"true\" above, because the\n * two fail differently: a stale \"true\" can put a sign-in bar in front of\n * someone who never asked for it, so it's kept short — a stale \"false\" only\n * ever hides chrome, so there's nothing to bound. It has to last as long as\n * the session it sits on top of: an editor who exited stays exited (instead of\n * the overlay reappearing by itself once a short timer lapsed) until they ask\n * for edit mode again with ?edit=true. Matches the Supabase session cookie's\n * 400 days.\n */\nexport const GR_EDIT_MODE_OFF_TTL_SECONDS = 400 * 24 * 60 * 60;\n\n/**\n * How long the set-a-password prompt stays up after an invite/recovery link\n * completes. Longer than the edit-mode window above — picking a password\n * takes more than one click — but still bounded, rather than nagging\n * indefinitely if it's skipped and the cookie is somehow never cleared.\n */\nexport const GR_NEEDS_PASSWORD_TTL_SECONDS = 30 * 60;\n\n/**\n * Dedicated Postgres schema, not `public`. A name prefix alone only guards\n * against accidental collisions; it does nothing against a `supabase db\n * reset`, a broad `DROP ... CASCADE`, or a migration tool that diffs and\n * \"reconciles\" everything in `public` as if it owns that namespace. A\n * separate schema keeps Guardrail's tables outside that blast radius —\n * the same reason auth.* and storage.* are their own schemas, not public.*.\n *\n * Requires \"guardrail\" to be added under Settings > API > Exposed schemas in\n * the Supabase dashboard — PostgREST only serves schemas on that list, and no\n * migration can add itself to it.\n */\nexport const GR_SCHEMA = \"guardrail\";\n\nexport const GR_TABLE = \"gr_content\";\nexport const GR_MEMBERS_TABLE = \"gr_members\";\nexport const GR_REPEATER_TABLE = \"gr_repeater_items\";\n"],"mappings":"AAAO,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBxB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQX,gBAAgB;AAClB;AAYO,MAAM,2BAA2B,KAAK;AAatC,MAAM,+BAA+B,MAAM,KAAK,KAAK;AAQrD,MAAM,gCAAgC,KAAK;AAc3C,MAAM,YAAY;AAElB,MAAM,WAAW;AACjB,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;","names":[]}
+{"version":3,"sources":["../../src/core/defs.ts"],"sourcesContent":["export const GR_COOKIES = {\n  /**\n   * Signals intent to edit. Carries no authority on its own — every write\n   * still goes through a real, server-verified role check, independent of\n   * this — but it does decide whether the admin chrome (the sign-in bar, or\n   * the toolbar) renders at all, so it is not harmless either: a stale copy\n   * of it is a real, if low-stakes, exposure (\"there's a CMS here\") to\n   * whoever's browser it's sitting in next, not just its original visitor.\n   *\n   * Values: \"true\" (show chrome — the short-lived grace window below, for\n   * someone not yet authenticated to reach the sign-in form), \"false\"\n   * (explicitly suppressed, e.g. ?edit=false previewing without chrome while\n   * still signed in), or absent. Absent defers entirely to whether a real\n   * session exists (see withGuardrail) — an authenticated editor's chrome\n   * persists for as long as their actual session does, with no separate\n   * timer of its own to fall out of sync with it.\n   */\n  EDIT_MODE: \"gr_edit_mode\",\n  /**\n   * Set server-side the moment a redirect-carried session (an invite or\n   * password-recovery link) completes, so the next render — which has no\n   * other way to know that just happened — prompts to set a password\n   * instead of showing the normal toolbar. Cleared once they do, or once\n   * they explicitly skip.\n   */\n  NEEDS_PASSWORD: \"gr_needs_password\",\n  /**\n   * Set server-side when an emailed link fails to complete — expired, already\n   * used, or malformed — so the next render can say so instead of leaving the\n   * person on a plain page wondering why nothing happened. Holds a short code\n   * (\"expired\" | \"failed\"), never the provider's own message. Short-lived and\n   * cleared when the message is dismissed.\n   */\n  AUTH_ERROR: \"gr_auth_error\",\n} as const;\n\n/** How long a \"that link didn't work\" message waits to be seen. */\nexport const GR_AUTH_ERROR_TTL_SECONDS = 2 * 60;\n\n/**\n * How long the edit-mode cookie's \"true\"/\"false\" values last before\n * reverting to the session-derived default. Short on purpose: it only ever\n * needs to outlive the handful of clicks between landing on ?edit=true and\n * actually typing a password (or, for ?edit=false, a quick chrome-free\n * preview) — not a whole working session, which persists through real auth\n * instead. Bounds how long a stray copy of this cookie can show anything to\n * whoever's browser it's left in, self-healing without needing an explicit\n * logout.\n */\nexport const GR_EDIT_MODE_TTL_SECONDS = 10 * 60;\n\n/**\n * How long an explicit \"off\" (the toolbar's exit button, ?edit=false, or the\n * sign-in bar's dismiss) is remembered. Long, unlike \"true\" above, because the\n * two fail differently: a stale \"true\" can put a sign-in bar in front of\n * someone who never asked for it, so it's kept short — a stale \"false\" only\n * ever hides chrome, so there's nothing to bound. It has to last as long as\n * the session it sits on top of: an editor who exited stays exited (instead of\n * the overlay reappearing by itself once a short timer lapsed) until they ask\n * for edit mode again with ?edit=true. Matches the Supabase session cookie's\n * 400 days.\n */\nexport const GR_EDIT_MODE_OFF_TTL_SECONDS = 400 * 24 * 60 * 60;\n\n/**\n * How long the set-a-password prompt stays up after an invite/recovery link\n * completes. Longer than the edit-mode window above — picking a password\n * takes more than one click — but still bounded, rather than nagging\n * indefinitely if it's skipped and the cookie is somehow never cleared.\n */\nexport const GR_NEEDS_PASSWORD_TTL_SECONDS = 30 * 60;\n\n/**\n * Dedicated Postgres schema, not `public`. A name prefix alone only guards\n * against accidental collisions; it does nothing against a `supabase db\n * reset`, a broad `DROP ... CASCADE`, or a migration tool that diffs and\n * \"reconciles\" everything in `public` as if it owns that namespace. A\n * separate schema keeps Guardrail's tables outside that blast radius —\n * the same reason auth.* and storage.* are their own schemas, not public.*.\n *\n * Requires \"guardrail\" to be added under Settings > API > Exposed schemas in\n * the Supabase dashboard — PostgREST only serves schemas on that list, and no\n * migration can add itself to it.\n */\nexport const GR_SCHEMA = \"guardrail\";\n\nexport const GR_TABLE = \"gr_content\";\nexport const GR_MEMBERS_TABLE = \"gr_members\";\nexport const GR_REPEATER_TABLE = \"gr_repeater_items\";\n"],"mappings":"AAAO,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBxB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQX,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhB,YAAY;AACd;AAGO,MAAM,4BAA4B,IAAI;AAYtC,MAAM,2BAA2B,KAAK;AAatC,MAAM,+BAA+B,MAAM,KAAK,KAAK;AAQrD,MAAM,gCAAgC,KAAK;AAc3C,MAAM,YAAY;AAElB,MAAM,WAAW;AACjB,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;","names":[]}

package/dist/core/types.d.ts

@@ -116,6 +116,12 @@ interface GRState {
     /** A redirect-carried session (an invite or recovery link) just completed
      * and has no password yet — see completeAuthRedirect. */
     needsPassword: boolean;
+    /**
+     * An emailed link just failed to complete — see GR_COOKIES.AUTH_ERROR. Set
+     * only for the render right after it happens, so the chrome can explain it
+     * and offer a fresh link.
+     */
+    authError?: "expired" | "failed";
     siteId: string;
     /** Null when the signed-in user holds no role on this site. */
     role: GRRole | null;

package/dist/email/resend.d.ts

@@ -1,4 +1,4 @@
-import { GRInviteEvent } from '../core/adapter-types.js';
+import { GRInviteEvent, GRPasswordResetEvent } from '../core/adapter-types.js';
 import 'react';
 import '../core/types.js';
 
@@ -9,26 +9,39 @@ interface ResendInviteContent {
     /** Plain-text alternative. Worth providing — some clients and spam filters prefer it. */
     text?: string;
 }
-/** What a custom template is given: the invite, plus the link and name to put in it. */
+/** What a custom invite template is given: the invite, plus the link and name to put in it. */
 type ResendInviteTemplateEvent = GRInviteEvent & {
     link: string;
     siteName: string;
 };
+/** What a custom password-reset template is given. */
+type ResendResetTemplateEvent = GRPasswordResetEvent & {
+    siteName: string;
+};
 interface ResendInviteOptions {
     /**
      * "Name <hello@yourdomain.com>". The domain has to be verified in Resend, or
      * Resend rejects the send.
      */
     from: string;
-    /** Resend API key. Defaults to `process.env.RESEND_API_KEY`, read when an invite is sent. */
+    /** Resend API key. Defaults to `process.env.RESEND_API_KEY`, read when an email is sent. */
     apiKey?: string;
-    /** Named in the default email. Defaults to the site id. */
+    /** Named in the default emails. Defaults to the site id. */
     siteName?: string;
-    /** Replaces the default email entirely — your own subject, markup, brand. */
+    /**
+     * Replaces the default invite email entirely — your own subject, markup, brand.
+     * Called for both a brand-new account (`isNewUser` true: the link lets them
+     * choose a password) and an existing one (`isNewUser` false: the link just
+     * opens the site, where they sign in with the password they already have).
+     */
     render?: (event: ResendInviteTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;
     /** Override the endpoint, e.g. for a proxy or a test server. */
     apiUrl?: string;
 }
+interface ResendEmailOptions extends ResendInviteOptions {
+    /** Replaces the default password-reset email. */
+    renderReset?: (event: ResendResetTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;
+}
 /**
  * An `onInvite` handler that emails the invitee through Resend.
  *
@@ -37,15 +50,31 @@ interface ResendInviteOptions {
  *     onInvite: resendInvite({ from: "Acme <hello@acme.com>", siteName: "Acme" }),
  *   });
  *
- * Needs an auth adapter that can create sign-in links (the Supabase adapter
- * can once it's given a serviceRoleKey); without a link there is nothing to
- * send, and it throws a message saying so. Throwing is how failures reach the
- * admin who clicked Invite — Resend rejecting the sender domain, say.
+ * Needs an auth adapter that can create links (the Supabase adapter can once
+ * it's given a serviceRoleKey); without a link there is nothing to send, and it
+ * throws a message saying so. Throwing is how failures reach the admin who
+ * clicked Invite — Resend rejecting the sender domain, say.
+ *
+ * To send password-reset emails the same way, use resendEmails() instead, which
+ * supplies both handlers.
  *
  * Calls Resend's HTTP API directly, so there is no SDK to install. To send
  * through anything else, write your own onInvite — the event carries the same
  * `link`.
  */
 declare function resendInvite(options: ResendInviteOptions): (event: GRInviteEvent) => Promise<void>;
+/**
+ * Both email handlers, backed by Resend: spread it into withGuardrail() and
+ * invites *and* password resets go out through your own domain.
+ *
+ *   withGuardrail(Layout, {
+ *     ...supabaseAdapters({ url, anonKey, serviceRoleKey }),
+ *     ...resendEmails({ from: "Acme <hello@acme.com>", siteName: "Acme" }),
+ *   });
+ */
+declare function resendEmails(options: ResendEmailOptions): {
+    onInvite: (event: GRInviteEvent) => Promise<void>;
+    onPasswordReset: (event: GRPasswordResetEvent) => Promise<void>;
+};
 
-export { type ResendInviteContent, type ResendInviteOptions, type ResendInviteTemplateEvent, resendInvite };
+export { type ResendEmailOptions, type ResendInviteContent, type ResendInviteOptions, type ResendInviteTemplateEvent, type ResendResetTemplateEvent, resendEmails, resendInvite };

package/dist/email/resend.js

@@ -1,75 +1,118 @@
 const RESEND_URL = "https://api.resend.com/emails";
+async function send(options, to, content) {
+  const apiKey = options.apiKey ?? process.env.RESEND_API_KEY;
+  if (!apiKey) throw new Error("RESEND_API_KEY is not set.");
+  const res = await fetch(options.apiUrl ?? RESEND_URL, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      from: options.from,
+      to: [to],
+      subject: content.subject,
+      html: content.html,
+      ...content.text ? { text: content.text } : {}
+    })
+  });
+  if (!res.ok) {
+    const detail = await res.json().then(
+      (body) => body?.message,
+      () => void 0
+    );
+    throw new Error(`Resend rejected the email (${res.status})${detail ? `: ${detail}` : "."}`);
+  }
+}
+async function sendInvite(options, event) {
+  if (!event.link) {
+    throw new Error(
+      "resendInvite needs a sign-in link, but the auth adapter didn't provide one \u2014 pass serviceRoleKey to supabaseAdapters() so it can create them."
+    );
+  }
+  const templateEvent = {
+    ...event,
+    link: event.link,
+    siteName: options.siteName ?? event.siteId
+  };
+  await send(options, event.email, await (options.render ?? defaultInviteEmail)(templateEvent));
+}
 function resendInvite(options) {
-  return async (event) => {
-    if (!event.link) {
-      throw new Error(
-        "resendInvite needs a sign-in link, but the auth adapter didn't provide one \u2014 pass serviceRoleKey to supabaseAdapters() so it can create them."
-      );
-    }
-    const apiKey = options.apiKey ?? process.env.RESEND_API_KEY;
-    if (!apiKey) throw new Error("RESEND_API_KEY is not set.");
-    const templateEvent = {
-      ...event,
-      link: event.link,
-      siteName: options.siteName ?? event.siteId
-    };
-    const content = await (options.render ?? defaultInviteEmail)(templateEvent);
-    const res = await fetch(options.apiUrl ?? RESEND_URL, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        from: options.from,
-        to: [event.email],
-        subject: content.subject,
-        html: content.html,
-        ...content.text ? { text: content.text } : {}
-      })
-    });
-    if (!res.ok) {
-      const detail = await res.json().then(
-        (body) => body?.message,
-        () => void 0
-      );
-      throw new Error(`Resend rejected the email (${res.status})${detail ? `: ${detail}` : "."}`);
+  return (event) => sendInvite(options, event);
+}
+function resendEmails(options) {
+  return {
+    onInvite: (event) => sendInvite(options, event),
+    onPasswordReset: async (event) => {
+      const templateEvent = {
+        ...event,
+        siteName: options.siteName ?? event.siteId
+      };
+      await send(options, event.email, await (options.renderReset ?? defaultResetEmail)(templateEvent));
     }
   };
 }
 function escapeHtml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function defaultInviteEmail(event) {
-  const site = event.siteName;
-  const who = event.invitedBy.includes("@") ? event.invitedBy : "An admin";
-  const intro = `${who} invited you to edit ${site} as an ${event.role}.`;
-  const action = event.isNewUser === false ? "Sign in" : "Set up your account";
-  const subject = event.isNewUser === false ? `Sign in to edit ${site}` : `You're invited to edit ${site}`;
+function layout(parts) {
   const html = `<!doctype html>
 <html>
   <body style="margin:0;padding:24px;background:#f6f6f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;color:#111;">
     <div style="max-width:480px;margin:0 auto;background:#fff;border-radius:8px;padding:32px;">
-      <h1 style="margin:0 0 12px;font-size:20px;">${escapeHtml(subject)}</h1>
-      <p style="margin:0 0 24px;line-height:1.5;">${escapeHtml(intro)}</p>
+      <h1 style="margin:0 0 12px;font-size:20px;">${escapeHtml(parts.subject)}</h1>
+      <p style="margin:0 0 24px;line-height:1.5;">${escapeHtml(parts.intro)}</p>
       <p style="margin:0 0 24px;">
-        <a href="${escapeHtml(event.link)}" style="display:inline-block;background:#111;color:#fff;text-decoration:none;padding:12px 20px;border-radius:6px;font-weight:600;">${escapeHtml(action)}</a>
+        <a href="${escapeHtml(parts.link)}" style="display:inline-block;background:#111;color:#fff;text-decoration:none;padding:12px 20px;border-radius:6px;font-weight:600;">${escapeHtml(parts.action)}</a>
       </p>
-      <p style="margin:0;font-size:13px;line-height:1.5;color:#666;">This link works once and expires, so open it on the device you'll use. If you weren't expecting this, you can ignore the email.</p>
+      <p style="margin:0;font-size:13px;line-height:1.5;color:#666;">${escapeHtml(parts.footnote)}</p>
     </div>
   </body>
 </html>`;
-  const text = `${subject}
+  const text = `${parts.subject}
 
-${intro}
+${parts.intro}
 
-${action}: ${event.link}
+${parts.action}: ${parts.link}
 
-This link works once and expires. If you weren't expecting this, you can ignore the email.
+${parts.footnote}
 `;
-  return { subject, html, text };
+  return { subject: parts.subject, html, text };
+}
+function inviteEmail(event) {
+  const site = event.siteName;
+  const who = event.invitedBy.includes("@") ? event.invitedBy : "An admin";
+  if (event.isNewUser === false) {
+    return layout({
+      subject: `You've been added to ${site}`,
+      intro: `${who} added you to ${site} as an ${event.role}. You already have an account, so sign in with the password you already use.`,
+      action: `Open ${site}`,
+      link: event.link,
+      footnote: `Forgot your password? Choose "Forgot password?" on the sign-in bar and we'll email you a link to choose a new one.`
+    });
+  }
+  return layout({
+    subject: `You're invited to edit ${site}`,
+    intro: `${who} invited you to edit ${site} as an ${event.role}. Choose a password to finish setting up your account.`,
+    action: "Set your password",
+    link: event.link,
+    footnote: "This link works once and expires, so open it on the device you'll use. After you set a password, that's how you'll sign in."
+  });
+}
+const defaultInviteEmail = inviteEmail;
+function defaultResetEmail(event) {
+  const site = event.siteName;
+  const intro = event.requestedBy === "self" ? `You asked to reset your password for ${site}. Use the button below to choose a new one.` : `An admin of ${site} sent you a link to choose a new password.`;
+  return layout({
+    subject: `Reset your password for ${site}`,
+    intro,
+    action: "Choose a new password",
+    link: event.link,
+    footnote: "This link works once and expires. If you weren't expecting this, you can ignore the email and your password won't change."
+  });
 }
 export {
+  resendEmails,
   resendInvite
 };
 //# sourceMappingURL=resend.js.map

package/dist/email/resend.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/email/resend.ts"],"sourcesContent":["import type { GRInviteEvent } from \"../core/adapter-types\";\n\n/** What gets sent: the pieces of one email. */\nexport interface ResendInviteContent {\n  subject: string;\n  html: string;\n  /** Plain-text alternative. Worth providing — some clients and spam filters prefer it. */\n  text?: string;\n}\n\n/** What a custom template is given: the invite, plus the link and name to put in it. */\nexport type ResendInviteTemplateEvent = GRInviteEvent & {\n  link: string;\n  siteName: string;\n};\n\nexport interface ResendInviteOptions {\n  /**\n   * \"Name <hello@yourdomain.com>\". The domain has to be verified in Resend, or\n   * Resend rejects the send.\n   */\n  from: string;\n  /** Resend API key. Defaults to `process.env.RESEND_API_KEY`, read when an invite is sent. */\n  apiKey?: string;\n  /** Named in the default email. Defaults to the site id. */\n  siteName?: string;\n  /** Replaces the default email entirely — your own subject, markup, brand. */\n  render?: (event: ResendInviteTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;\n  /** Override the endpoint, e.g. for a proxy or a test server. */\n  apiUrl?: string;\n}\n\nconst RESEND_URL = \"https://api.resend.com/emails\";\n\n/**\n * An `onInvite` handler that emails the invitee through Resend.\n *\n *   withGuardrail(Layout, {\n *     ...supabaseAdapters({ url, anonKey, serviceRoleKey }),\n *     onInvite: resendInvite({ from: \"Acme <hello@acme.com>\", siteName: \"Acme\" }),\n *   });\n *\n * Needs an auth adapter that can create sign-in links (the Supabase adapter\n * can once it's given a serviceRoleKey); without a link there is nothing to\n * send, and it throws a message saying so. Throwing is how failures reach the\n * admin who clicked Invite — Resend rejecting the sender domain, say.\n *\n * Calls Resend's HTTP API directly, so there is no SDK to install. To send\n * through anything else, write your own onInvite — the event carries the same\n * `link`.\n */\nexport function resendInvite(options: ResendInviteOptions) {\n  return async (event: GRInviteEvent): Promise<void> => {\n    if (!event.link) {\n      throw new Error(\n        \"resendInvite needs a sign-in link, but the auth adapter didn't provide one — \" +\n          \"pass serviceRoleKey to supabaseAdapters() so it can create them.\",\n      );\n    }\n    const apiKey = options.apiKey ?? process.env.RESEND_API_KEY;\n    if (!apiKey) throw new Error(\"RESEND_API_KEY is not set.\");\n\n    const templateEvent: ResendInviteTemplateEvent = {\n      ...event,\n      link: event.link,\n      siteName: options.siteName ?? event.siteId,\n    };\n    const content = await (options.render ?? defaultInviteEmail)(templateEvent);\n\n    const res = await fetch(options.apiUrl ?? RESEND_URL, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({\n        from: options.from,\n        to: [event.email],\n        subject: content.subject,\n        html: content.html,\n        ...(content.text ? { text: content.text } : {}),\n      }),\n    });\n\n    if (!res.ok) {\n      const detail = await res.json().then(\n        (body: { message?: string }) => body?.message,\n        () => undefined,\n      );\n      throw new Error(`Resend rejected the email (${res.status})${detail ? `: ${detail}` : \".\"}`);\n    }\n  };\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * The email used when no `render` is given: plain, one button, readable\n * everywhere. Interpolated values are escaped — the site name and inviter come\n * from config and from a person, and neither belongs in markup unescaped.\n */\nfunction defaultInviteEmail(event: ResendInviteTemplateEvent): ResendInviteContent {\n  const site = event.siteName;\n  const who = event.invitedBy.includes(\"@\") ? event.invitedBy : \"An admin\";\n  const intro = `${who} invited you to edit ${site} as an ${event.role}.`;\n  const action = event.isNewUser === false ? \"Sign in\" : \"Set up your account\";\n  const subject = event.isNewUser === false ? `Sign in to edit ${site}` : `You're invited to edit ${site}`;\n\n  const html = `<!doctype html>\n<html>\n  <body style=\"margin:0;padding:24px;background:#f6f6f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;color:#111;\">\n    <div style=\"max-width:480px;margin:0 auto;background:#fff;border-radius:8px;padding:32px;\">\n      <h1 style=\"margin:0 0 12px;font-size:20px;\">${escapeHtml(subject)}</h1>\n      <p style=\"margin:0 0 24px;line-height:1.5;\">${escapeHtml(intro)}</p>\n      <p style=\"margin:0 0 24px;\">\n        <a href=\"${escapeHtml(event.link)}\" style=\"display:inline-block;background:#111;color:#fff;text-decoration:none;padding:12px 20px;border-radius:6px;font-weight:600;\">${escapeHtml(action)}</a>\n      </p>\n      <p style=\"margin:0;font-size:13px;line-height:1.5;color:#666;\">This link works once and expires, so open it on the device you'll use. If you weren't expecting this, you can ignore the email.</p>\n    </div>\n  </body>\n</html>`;\n\n  const text = `${subject}\\n\\n${intro}\\n\\n${action}: ${event.link}\\n\\nThis link works once and expires. If you weren't expecting this, you can ignore the email.\\n`;\n  return { subject, html, text };\n}\n"],"mappings":"AAgCA,MAAM,aAAa;AAmBZ,SAAS,aAAa,SAA8B;AACzD,SAAO,OAAO,UAAwC;AACpD,QAAI,CAAC,MAAM,MAAM;AACf,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI;AAC7C,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,4BAA4B;AAEzD,UAAM,gBAA2C;AAAA,MAC/C,GAAG;AAAA,MACH,MAAM,MAAM;AAAA,MACZ,UAAU,QAAQ,YAAY,MAAM;AAAA,IACtC;AACA,UAAM,UAAU,OAAO,QAAQ,UAAU,oBAAoB,aAAa;AAE1E,UAAM,MAAM,MAAM,MAAM,QAAQ,UAAU,YAAY;AAAA,MACpD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,MAAM;AAAA,QAC/B,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,MAAM,QAAQ;AAAA,QACd,IAAI,CAAC,MAAM,KAAK;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB,MAAM,QAAQ;AAAA,QACd,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC/C,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,SAAS,MAAM,IAAI,KAAK,EAAE;AAAA,QAC9B,CAAC,SAA+B,MAAM;AAAA,QACtC,MAAM;AAAA,MACR;AACA,YAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,IAAI,SAAS,KAAK,MAAM,KAAK,GAAG,EAAE;AAAA,IAC5F;AAAA,EACF;AACF;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,MACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,OAAO;AAC1B;AAOA,SAAS,mBAAmB,OAAuD;AACjF,QAAM,OAAO,MAAM;AACnB,QAAM,MAAM,MAAM,UAAU,SAAS,GAAG,IAAI,MAAM,YAAY;AAC9D,QAAM,QAAQ,GAAG,GAAG,wBAAwB,IAAI,UAAU,MAAM,IAAI;AACpE,QAAM,SAAS,MAAM,cAAc,QAAQ,YAAY;AACvD,QAAM,UAAU,MAAM,cAAc,QAAQ,mBAAmB,IAAI,KAAK,0BAA0B,IAAI;AAEtG,QAAM,OAAO;AAAA;AAAA;AAAA;AAAA,oDAIqC,WAAW,OAAO,CAAC;AAAA,oDACnB,WAAW,KAAK,CAAC;AAAA;AAAA,mBAElD,WAAW,MAAM,IAAI,CAAC,uIAAuI,WAAW,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAOhM,QAAM,OAAO,GAAG,OAAO;AAAA;AAAA,EAAO,KAAK;AAAA;AAAA,EAAO,MAAM,KAAK,MAAM,IAAI;AAAA;AAAA;AAAA;AAC/D,SAAO,EAAE,SAAS,MAAM,KAAK;AAC/B;","names":[]}
+{"version":3,"sources":["../../src/email/resend.ts"],"sourcesContent":["import type { GRInviteEvent, GRPasswordResetEvent } from \"../core/adapter-types\";\n\n/** What gets sent: the pieces of one email. */\nexport interface ResendInviteContent {\n  subject: string;\n  html: string;\n  /** Plain-text alternative. Worth providing — some clients and spam filters prefer it. */\n  text?: string;\n}\n\n/** What a custom invite template is given: the invite, plus the link and name to put in it. */\nexport type ResendInviteTemplateEvent = GRInviteEvent & {\n  link: string;\n  siteName: string;\n};\n\n/** What a custom password-reset template is given. */\nexport type ResendResetTemplateEvent = GRPasswordResetEvent & {\n  siteName: string;\n};\n\nexport interface ResendInviteOptions {\n  /**\n   * \"Name <hello@yourdomain.com>\". The domain has to be verified in Resend, or\n   * Resend rejects the send.\n   */\n  from: string;\n  /** Resend API key. Defaults to `process.env.RESEND_API_KEY`, read when an email is sent. */\n  apiKey?: string;\n  /** Named in the default emails. Defaults to the site id. */\n  siteName?: string;\n  /**\n   * Replaces the default invite email entirely — your own subject, markup, brand.\n   * Called for both a brand-new account (`isNewUser` true: the link lets them\n   * choose a password) and an existing one (`isNewUser` false: the link just\n   * opens the site, where they sign in with the password they already have).\n   */\n  render?: (event: ResendInviteTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;\n  /** Override the endpoint, e.g. for a proxy or a test server. */\n  apiUrl?: string;\n}\n\nexport interface ResendEmailOptions extends ResendInviteOptions {\n  /** Replaces the default password-reset email. */\n  renderReset?: (event: ResendResetTemplateEvent) => ResendInviteContent | Promise<ResendInviteContent>;\n}\n\nconst RESEND_URL = \"https://api.resend.com/emails\";\n\nasync function send(\n  options: ResendInviteOptions,\n  to: string,\n  content: ResendInviteContent,\n): Promise<void> {\n  const apiKey = options.apiKey ?? process.env.RESEND_API_KEY;\n  if (!apiKey) throw new Error(\"RESEND_API_KEY is not set.\");\n\n  const res = await fetch(options.apiUrl ?? RESEND_URL, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      from: options.from,\n      to: [to],\n      subject: content.subject,\n      html: content.html,\n      ...(content.text ? { text: content.text } : {}),\n    }),\n  });\n\n  if (!res.ok) {\n    const detail = await res.json().then(\n      (body: { message?: string }) => body?.message,\n      () => undefined,\n    );\n    throw new Error(`Resend rejected the email (${res.status})${detail ? `: ${detail}` : \".\"}`);\n  }\n}\n\nasync function sendInvite(options: ResendInviteOptions, event: GRInviteEvent): Promise<void> {\n  if (!event.link) {\n    throw new Error(\n      \"resendInvite needs a sign-in link, but the auth adapter didn't provide one — \" +\n        \"pass serviceRoleKey to supabaseAdapters() so it can create them.\",\n    );\n  }\n  const templateEvent: ResendInviteTemplateEvent = {\n    ...event,\n    link: event.link,\n    siteName: options.siteName ?? event.siteId,\n  };\n  await send(options, event.email, await (options.render ?? defaultInviteEmail)(templateEvent));\n}\n\n/**\n * An `onInvite` handler that emails the invitee through Resend.\n *\n *   withGuardrail(Layout, {\n *     ...supabaseAdapters({ url, anonKey, serviceRoleKey }),\n *     onInvite: resendInvite({ from: \"Acme <hello@acme.com>\", siteName: \"Acme\" }),\n *   });\n *\n * Needs an auth adapter that can create links (the Supabase adapter can once\n * it's given a serviceRoleKey); without a link there is nothing to send, and it\n * throws a message saying so. Throwing is how failures reach the admin who\n * clicked Invite — Resend rejecting the sender domain, say.\n *\n * To send password-reset emails the same way, use resendEmails() instead, which\n * supplies both handlers.\n *\n * Calls Resend's HTTP API directly, so there is no SDK to install. To send\n * through anything else, write your own onInvite — the event carries the same\n * `link`.\n */\nexport function resendInvite(options: ResendInviteOptions) {\n  return (event: GRInviteEvent): Promise<void> => sendInvite(options, event);\n}\n\n/**\n * Both email handlers, backed by Resend: spread it into withGuardrail() and\n * invites *and* password resets go out through your own domain.\n *\n *   withGuardrail(Layout, {\n *     ...supabaseAdapters({ url, anonKey, serviceRoleKey }),\n *     ...resendEmails({ from: \"Acme <hello@acme.com>\", siteName: \"Acme\" }),\n *   });\n */\nexport function resendEmails(options: ResendEmailOptions) {\n  return {\n    onInvite: (event: GRInviteEvent): Promise<void> => sendInvite(options, event),\n    onPasswordReset: async (event: GRPasswordResetEvent): Promise<void> => {\n      const templateEvent: ResendResetTemplateEvent = {\n        ...event,\n        siteName: options.siteName ?? event.siteId,\n      };\n      await send(options, event.email, await (options.renderReset ?? defaultResetEmail)(templateEvent));\n    },\n  };\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * One plain, readable-everywhere email: a heading, a sentence, one button, a\n * footnote. Interpolated values are escaped — the site name and inviter come\n * from config and from a person, and neither belongs in markup unescaped.\n */\nfunction layout(parts: {\n  subject: string;\n  intro: string;\n  action: string;\n  link: string;\n  footnote: string;\n}): ResendInviteContent {\n  const html = `<!doctype html>\n<html>\n  <body style=\"margin:0;padding:24px;background:#f6f6f6;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;color:#111;\">\n    <div style=\"max-width:480px;margin:0 auto;background:#fff;border-radius:8px;padding:32px;\">\n      <h1 style=\"margin:0 0 12px;font-size:20px;\">${escapeHtml(parts.subject)}</h1>\n      <p style=\"margin:0 0 24px;line-height:1.5;\">${escapeHtml(parts.intro)}</p>\n      <p style=\"margin:0 0 24px;\">\n        <a href=\"${escapeHtml(parts.link)}\" style=\"display:inline-block;background:#111;color:#fff;text-decoration:none;padding:12px 20px;border-radius:6px;font-weight:600;\">${escapeHtml(parts.action)}</a>\n      </p>\n      <p style=\"margin:0;font-size:13px;line-height:1.5;color:#666;\">${escapeHtml(parts.footnote)}</p>\n    </div>\n  </body>\n</html>`;\n  const text = `${parts.subject}\\n\\n${parts.intro}\\n\\n${parts.action}: ${parts.link}\\n\\n${parts.footnote}\\n`;\n  return { subject: parts.subject, html, text };\n}\n\nfunction inviteEmail(event: ResendInviteTemplateEvent): ResendInviteContent {\n  const site = event.siteName;\n  const who = event.invitedBy.includes(\"@\") ? event.invitedBy : \"An admin\";\n\n  if (event.isNewUser === false) {\n    return layout({\n      subject: `You've been added to ${site}`,\n      intro: `${who} added you to ${site} as an ${event.role}. You already have an account, so sign in with the password you already use.`,\n      action: `Open ${site}`,\n      link: event.link,\n      footnote: `Forgot your password? Choose \"Forgot password?\" on the sign-in bar and we'll email you a link to choose a new one.`,\n    });\n  }\n  return layout({\n    subject: `You're invited to edit ${site}`,\n    intro: `${who} invited you to edit ${site} as an ${event.role}. Choose a password to finish setting up your account.`,\n    action: \"Set your password\",\n    link: event.link,\n    footnote: \"This link works once and expires, so open it on the device you'll use. After you set a password, that's how you'll sign in.\",\n  });\n}\n\nconst defaultInviteEmail = inviteEmail;\n\nfunction defaultResetEmail(event: ResendResetTemplateEvent): ResendInviteContent {\n  const site = event.siteName;\n  const intro =\n    event.requestedBy === \"self\"\n      ? `You asked to reset your password for ${site}. Use the button below to choose a new one.`\n      : `An admin of ${site} sent you a link to choose a new password.`;\n  return layout({\n    subject: `Reset your password for ${site}`,\n    intro,\n    action: \"Choose a new password\",\n    link: event.link,\n    footnote: \"This link works once and expires. If you weren't expecting this, you can ignore the email and your password won't change.\",\n  });\n}\n"],"mappings":"AA+CA,MAAM,aAAa;AAEnB,eAAe,KACb,SACA,IACA,SACe;AACf,QAAM,SAAS,QAAQ,UAAU,QAAQ,IAAI;AAC7C,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,4BAA4B;AAEzD,QAAM,MAAM,MAAM,MAAM,QAAQ,UAAU,YAAY;AAAA,IACpD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,MAAM;AAAA,MAC/B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,MAAM,QAAQ;AAAA,MACd,IAAI,CAAC,EAAE;AAAA,MACP,SAAS,QAAQ;AAAA,MACjB,MAAM,QAAQ;AAAA,MACd,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC/C,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,SAAS,MAAM,IAAI,KAAK,EAAE;AAAA,MAC9B,CAAC,SAA+B,MAAM;AAAA,MACtC,MAAM;AAAA,IACR;AACA,UAAM,IAAI,MAAM,8BAA8B,IAAI,MAAM,IAAI,SAAS,KAAK,MAAM,KAAK,GAAG,EAAE;AAAA,EAC5F;AACF;AAEA,eAAe,WAAW,SAA8B,OAAqC;AAC3F,MAAI,CAAC,MAAM,MAAM;AACf,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,gBAA2C;AAAA,IAC/C,GAAG;AAAA,IACH,MAAM,MAAM;AAAA,IACZ,UAAU,QAAQ,YAAY,MAAM;AAAA,EACtC;AACA,QAAM,KAAK,SAAS,MAAM,OAAO,OAAO,QAAQ,UAAU,oBAAoB,aAAa,CAAC;AAC9F;AAsBO,SAAS,aAAa,SAA8B;AACzD,SAAO,CAAC,UAAwC,WAAW,SAAS,KAAK;AAC3E;AAWO,SAAS,aAAa,SAA6B;AACxD,SAAO;AAAA,IACL,UAAU,CAAC,UAAwC,WAAW,SAAS,KAAK;AAAA,IAC5E,iBAAiB,OAAO,UAA+C;AACrE,YAAM,gBAA0C;AAAA,QAC9C,GAAG;AAAA,QACH,UAAU,QAAQ,YAAY,MAAM;AAAA,MACtC;AACA,YAAM,KAAK,SAAS,MAAM,OAAO,OAAO,QAAQ,eAAe,mBAAmB,aAAa,CAAC;AAAA,IAClG;AAAA,EACF;AACF;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,MACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,OAAO;AAC1B;AAOA,SAAS,OAAO,OAMQ;AACtB,QAAM,OAAO;AAAA;AAAA;AAAA;AAAA,oDAIqC,WAAW,MAAM,OAAO,CAAC;AAAA,oDACzB,WAAW,MAAM,KAAK,CAAC;AAAA;AAAA,mBAExD,WAAW,MAAM,IAAI,CAAC,uIAAuI,WAAW,MAAM,MAAM,CAAC;AAAA;AAAA,uEAEjI,WAAW,MAAM,QAAQ,CAAC;AAAA;AAAA;AAAA;AAI/F,QAAM,OAAO,GAAG,MAAM,OAAO;AAAA;AAAA,EAAO,MAAM,KAAK;AAAA;AAAA,EAAO,MAAM,MAAM,KAAK,MAAM,IAAI;AAAA;AAAA,EAAO,MAAM,QAAQ;AAAA;AACtG,SAAO,EAAE,SAAS,MAAM,SAAS,MAAM,KAAK;AAC9C;AAEA,SAAS,YAAY,OAAuD;AAC1E,QAAM,OAAO,MAAM;AACnB,QAAM,MAAM,MAAM,UAAU,SAAS,GAAG,IAAI,MAAM,YAAY;AAE9D,MAAI,MAAM,cAAc,OAAO;AAC7B,WAAO,OAAO;AAAA,MACZ,SAAS,wBAAwB,IAAI;AAAA,MACrC,OAAO,GAAG,GAAG,iBAAiB,IAAI,UAAU,MAAM,IAAI;AAAA,MACtD,QAAQ,QAAQ,IAAI;AAAA,MACpB,MAAM,MAAM;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO,OAAO;AAAA,IACZ,SAAS,0BAA0B,IAAI;AAAA,IACvC,OAAO,GAAG,GAAG,wBAAwB,IAAI,UAAU,MAAM,IAAI;AAAA,IAC7D,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,IACZ,UAAU;AAAA,EACZ,CAAC;AACH;AAEA,MAAM,qBAAqB;AAE3B,SAAS,kBAAkB,OAAsD;AAC/E,QAAM,OAAO,MAAM;AACnB,QAAM,QACJ,MAAM,gBAAgB,SAClB,wCAAwC,IAAI,gDAC5C,eAAe,IAAI;AACzB,SAAO,OAAO;AAAA,IACZ,SAAS,2BAA2B,IAAI;AAAA,IACxC;AAAA,IACA,QAAQ;AAAA,IACR,MAAM,MAAM;AAAA,IACZ,UAAU;AAAA,EACZ,CAAC;AACH;","names":[]}

package/dist/index.client.d.ts

@@ -1,11 +1,11 @@
 export { GRail } from './react/GRail/universal.js';
 export { useGRail } from './react/Provider.js';
-export { createAssetUpload, inviteMember, listAssets, listTeam, removeMember, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
+export { createAssetUpload, forgotPasswordAction, inviteMember, listAssets, listTeam, removeMember, sendPasswordResetAction, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { GRepeaterProps, RepeaterItemProps } from './react/Repeater/index.js';
-export { ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent } from './email/resend.js';
+export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent } from './email/resend.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';
 
@@ -19,5 +19,6 @@ declare const isAdmin: (..._args: unknown[]) => never;
 declare const isEditor: (..._args: unknown[]) => never;
 declare const canEdit: (..._args: unknown[]) => never;
 declare const resendInvite: (..._args: unknown[]) => never;
+declare const resendEmails: (..._args: unknown[]) => never;
 
-export { GRepeater, canEdit, configureGuardrail, getFieldValue, getRepeaterItemBySlug, isAdmin, isEditor, listRepeaterItems, resendInvite, withGuardrail };
+export { GRepeater, canEdit, configureGuardrail, getFieldValue, getRepeaterItemBySlug, isAdmin, isEditor, listRepeaterItems, resendEmails, resendInvite, withGuardrail };

package/dist/index.client.js

@@ -9,6 +9,8 @@ import {
   listAssets,
   setPasswordAction,
   skipSetPasswordAction,
+  forgotPasswordAction,
+  sendPasswordResetAction,
   setFieldValue
 } from "./server/actions";
 import {
@@ -63,6 +65,10 @@ const resendInvite = serverOnly(
   "resendInvite()",
   "Pass it as onInvite in withGuardrail(), which runs in your root layout."
 );
+const resendEmails = serverOnly(
+  "resendEmails()",
+  "Spread it into withGuardrail(), which runs in your root layout."
+);
 export {
   GRail,
   GRepeater,
@@ -70,6 +76,7 @@ export {
   canEdit,
   configureGuardrail,
   createAssetUpload,
+  forgotPasswordAction,
   getFieldValue,
   getRepeaterItemBySlug,
   inviteMember,
@@ -81,7 +88,9 @@ export {
   removeMember,
   removeRepeaterItem,
   reorderRepeaterItems,
+  resendEmails,
   resendInvite,
+  sendPasswordResetAction,
   setFieldValue,
   setPasswordAction,
   skipSetPasswordAction,