@guard-rail/core 0.8.0 → 0.9.0

package/dist/index.client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;","names":[]}
+{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,15 +1,15 @@
 export { withGuardrail } from './server/wrapper.js';
-export { createAssetUpload, inviteMember, listAssets, listTeam, removeMember, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
+export { createAssetUpload, forgotPasswordAction, inviteMember, listAssets, listTeam, removeMember, sendPasswordResetAction, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
 export { GRail } from './react/GRail/index.js';
 export { GRepeater, GRepeaterProps, RepeaterItemProps } from './react/Repeater/index.js';
 export { configureGuardrail } from './core/config.js';
 export { getRepeaterItemBySlug, listRepeaterItems } from './server/repeaterData.js';
 export { getFieldValue } from './server/fieldData.js';
 export { canEdit, isAdmin, isEditor } from './server/access.js';
-export { ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, resendInvite } from './email/resend.js';
+export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent, resendEmails, resendInvite } from './email/resend.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { useGRail } from './react/Provider.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/index.js

@@ -8,6 +8,8 @@ import {
   listAssets,
   setPasswordAction,
   skipSetPasswordAction,
+  forgotPasswordAction,
+  sendPasswordResetAction,
   setFieldValue
 } from "./server/actions";
 import { GRail } from "./react/GRail";
@@ -19,7 +21,7 @@ import {
 } from "./server/repeaterData";
 import { getFieldValue } from "./server/fieldData";
 import { isAdmin, isEditor, canEdit } from "./server/access";
-import { resendInvite } from "./email/resend";
+import { resendInvite, resendEmails } from "./email/resend";
 import {
   addRepeaterItem,
   removeRepeaterItem,
@@ -33,6 +35,7 @@ export {
   canEdit,
   configureGuardrail,
   createAssetUpload,
+  forgotPasswordAction,
   getFieldValue,
   getRepeaterItemBySlug,
   inviteMember,
@@ -44,7 +47,9 @@ export {
   removeMember,
   removeRepeaterItem,
   reorderRepeaterItems,
+  resendEmails,
   resendInvite,
+  sendPasswordResetAction,
   setFieldValue,
   setPasswordAction,
   skipSetPasswordAction,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite } from \"./email/resend\";\nexport type {\n  ResendInviteOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,oBAAoB;AAQ7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAU3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}

package/dist/react/Admin.js

@@ -2,19 +2,14 @@
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import React, { useActionState, useEffect, useState } from "react";
 import { usePathname, useRouter } from "next/navigation";
-import {
-  loginAction,
-  logoutAction,
-  setPasswordAction,
-  skipSetPasswordAction
-} from "../server/actions";
+import { loginAction, logoutAction } from "../server/actions";
 import { useGRail } from "./Provider";
 import { TeamDrawer } from "./Team";
+import { AuthDrawer } from "./AuthDrawer";
 import { CloseIcon, LogOutIcon, PeopleIcon } from "./Icons";
 import { S, THEME_CSS, v } from "./styles";
 import { GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS } from "../core/defs";
 const initialState = { email: "", password: "" };
-const initialPasswordState = {};
 function GRailAdmin(props) {
   const { isEditMode } = useGRail();
   if (!isEditMode) return null;
@@ -24,28 +19,33 @@ function GRailAdmin(props) {
   ] });
 }
 function AdminBody({ toolbarExtra }) {
-  const { isAuth, isEditMode, needsPassword, role, auth } = useGRail();
+  const { isAuth, isEditMode, needsPassword, authError, role, auth } = useGRail();
   const [teamOpen, setTeamOpen] = useState(false);
+  const [forgotOpen, setForgotOpen] = useState(false);
+  const [errorDismissed, setErrorDismissed] = useState(false);
   const [formState, formAction, isPending] = useActionState(
     loginAction,
     initialState
   );
-  const [passwordState, passwordFormAction, isSettingPassword] = useActionState(
-    setPasswordAction,
-    initialPasswordState
-  );
   const router = useRouter();
   const pathname = usePathname();
   useEffect(() => {
     if (formState.success) router.refresh();
   }, [formState.success, router]);
-  useEffect(() => {
-    if (passwordState.success) router.refresh();
-  }, [passwordState.success, router]);
-  const skipSetPassword = async () => {
-    await skipSetPasswordAction();
+  const dismissAuthError = () => {
+    document.cookie = `${GR_COOKIES.AUTH_ERROR}=; path=/; max-age=0; SameSite=Lax`;
+    setErrorDismissed(true);
     router.refresh();
   };
+  const linkErrorDrawer = authError && !errorDismissed ? /* @__PURE__ */ jsx(
+    AuthDrawer,
+    {
+      mode: "forgot",
+      title: "That link didn't work",
+      message: authError === "expired" ? "It has expired or was already used. Links work once. Enter your email to get a new one." : "We couldn't complete it. Enter your email to get a new link.",
+      onClose: dismissAuthError
+    }
+  ) : null;
   const exitEditMode = () => {
     document.cookie = `${GR_COOKIES.EDIT_MODE}=false; path=/; max-age=${GR_EDIT_MODE_OFF_TTL_SECONDS}; SameSite=Lax`;
     router.replace(pathname);
@@ -59,12 +59,76 @@ function AdminBody({ toolbarExtra }) {
   if (!isEditMode) return null;
   if (!isAuth) {
     if (!auth.password) {
-      return /* @__PURE__ */ jsx("div", { "data-guardrail": true, style: S.banner, children: /* @__PURE__ */ jsxs("div", { style: S.bannerForm, children: [
+      return /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx("div", { "data-guardrail": true, style: S.banner, children: /* @__PURE__ */ jsxs("div", { style: S.bannerForm, children: [
+          /* @__PURE__ */ jsxs("div", { style: S.brandStack, children: [
+            /* @__PURE__ */ jsx("span", { style: S.brand, children: "Guardrail" }),
+            !auth.signInUrl && /* @__PURE__ */ jsx("span", { style: { fontSize: 12, color: v("muted") }, children: "No sign-in method is configured for this site." })
+          ] }),
+          auth.signInUrl && /* @__PURE__ */ jsx("a", { href: auth.signInUrl, style: { ...S.primaryBtn, textDecoration: "none" }, children: "Sign in" }),
+          /* @__PURE__ */ jsx(
+            "button",
+            {
+              type: "button",
+              style: { ...S.iconBtn, color: v("muted") },
+              onClick: exitEditMode,
+              title: "Not editing? Dismiss",
+              "aria-label": "Dismiss",
+              children: /* @__PURE__ */ jsx(CloseIcon, {})
+            }
+          )
+        ] }) }),
+        linkErrorDrawer
+      ] });
+    }
+    return /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("div", { "data-guardrail": true, style: S.banner, children: /* @__PURE__ */ jsxs("form", { action: formAction, style: S.bannerForm, children: [
         /* @__PURE__ */ jsxs("div", { style: S.brandStack, children: [
           /* @__PURE__ */ jsx("span", { style: S.brand, children: "Guardrail" }),
-          !auth.signInUrl && /* @__PURE__ */ jsx("span", { style: { fontSize: 12, color: v("muted") }, children: "No sign-in method is configured for this site." })
+          formState.error && /* @__PURE__ */ jsx("span", { style: S.error, children: formState.error })
         ] }),
-        auth.signInUrl && /* @__PURE__ */ jsx("a", { href: auth.signInUrl, style: { ...S.primaryBtn, textDecoration: "none" }, children: "Sign in" }),
+        /* @__PURE__ */ jsx(
+          "input",
+          {
+            name: "email",
+            type: "email",
+            autoComplete: "email",
+            placeholder: "Email",
+            defaultValue: formState.email,
+            required: true,
+            style: S.input
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "input",
+          {
+            name: "password",
+            type: "password",
+            autoComplete: "current-password",
+            placeholder: "Password",
+            required: true,
+            style: S.input
+          }
+        ),
+        /* @__PURE__ */ jsx("button", { type: "submit", disabled: isPending, style: S.primaryBtn, children: isPending ? "Authenticating\u2026" : "Sign In" }),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => setForgotOpen(true),
+            style: {
+              background: "none",
+              border: "none",
+              cursor: "pointer",
+              color: v("muted"),
+              fontSize: 12,
+              textDecoration: "underline",
+              padding: "0 4px",
+              whiteSpace: "nowrap"
+            },
+            children: "Forgot password?"
+          }
+        ),
         /* @__PURE__ */ jsx(
           "button",
           {
@@ -76,98 +140,32 @@ function AdminBody({ toolbarExtra }) {
             children: /* @__PURE__ */ jsx(CloseIcon, {})
           }
         )
-      ] }) });
-    }
-    return /* @__PURE__ */ jsx("div", { "data-guardrail": true, style: S.banner, children: /* @__PURE__ */ jsxs("form", { action: formAction, style: S.bannerForm, children: [
-      /* @__PURE__ */ jsxs("div", { style: S.brandStack, children: [
-        /* @__PURE__ */ jsx("span", { style: S.brand, children: "Guardrail" }),
-        formState.error && /* @__PURE__ */ jsx("span", { style: S.error, children: formState.error })
-      ] }),
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          name: "email",
-          type: "email",
-          autoComplete: "email",
-          placeholder: "Email",
-          defaultValue: formState.email,
-          required: true,
-          style: S.input
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          name: "password",
-          type: "password",
-          autoComplete: "current-password",
-          placeholder: "Password",
-          required: true,
-          style: S.input
-        }
-      ),
-      /* @__PURE__ */ jsx("button", { type: "submit", disabled: isPending, style: S.primaryBtn, children: isPending ? "Authenticating\u2026" : "Sign In" }),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          style: { ...S.iconBtn, color: v("muted") },
-          onClick: exitEditMode,
-          title: "Not editing? Dismiss",
-          "aria-label": "Dismiss",
-          children: /* @__PURE__ */ jsx(CloseIcon, {})
-        }
-      )
-    ] }) });
-  }
-  if (needsPassword) {
-    return /* @__PURE__ */ jsx("div", { "data-guardrail": true, style: S.banner, children: /* @__PURE__ */ jsxs("form", { action: passwordFormAction, style: S.bannerForm, children: [
-      /* @__PURE__ */ jsxs("div", { style: S.brandStack, children: [
-        /* @__PURE__ */ jsx("span", { style: S.brand, children: "Guardrail" }),
-        passwordState.error ? /* @__PURE__ */ jsx("span", { style: S.error, children: passwordState.error }) : /* @__PURE__ */ jsx("span", { style: { fontSize: 12, color: v("muted") }, children: "Set a password to sign in next time" })
-      ] }),
-      /* @__PURE__ */ jsx(
-        "input",
-        {
-          name: "password",
-          type: "password",
-          placeholder: "New password",
-          required: true,
-          minLength: 6,
-          style: S.input
-        }
-      ),
-      /* @__PURE__ */ jsx("button", { type: "submit", disabled: isSettingPassword, style: S.primaryBtn, children: isSettingPassword ? "Saving\u2026" : "Set Password" }),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          style: { ...S.iconBtn, color: v("muted") },
-          onClick: skipSetPassword,
-          title: "Skip for now",
-          "aria-label": "Skip",
-          children: /* @__PURE__ */ jsx(CloseIcon, {})
-        }
-      )
-    ] }) });
+      ] }) }),
+      linkErrorDrawer ?? (forgotOpen && /* @__PURE__ */ jsx(AuthDrawer, { mode: "forgot", onClose: () => setForgotOpen(false) }))
+    ] });
   }
+  if (needsPassword) return /* @__PURE__ */ jsx(AuthDrawer, { mode: "set-password" });
   if (!role) {
-    return /* @__PURE__ */ jsxs("div", { "data-guardrail": true, style: S.toolbar, children: [
-      /* @__PURE__ */ jsx("span", { style: S.toolbarLabel, children: "No access to this site" }),
-      /* @__PURE__ */ jsx("span", { style: S.divider }),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          style: { ...S.iconBtn, color: v("muted") },
-          onClick: signOut,
-          title: "Sign out",
-          "aria-label": "Sign out",
-          children: /* @__PURE__ */ jsx(LogOutIcon, {})
-        }
-      )
+    return /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsxs("div", { "data-guardrail": true, style: S.toolbar, children: [
+        /* @__PURE__ */ jsx("span", { style: S.toolbarLabel, children: "No access to this site" }),
+        /* @__PURE__ */ jsx("span", { style: S.divider }),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            style: { ...S.iconBtn, color: v("muted") },
+            onClick: signOut,
+            title: "Sign out",
+            "aria-label": "Sign out",
+            children: /* @__PURE__ */ jsx(LogOutIcon, {})
+          }
+        )
+      ] }),
+      linkErrorDrawer
     ] });
   }
   return /* @__PURE__ */ jsxs(Fragment, { children: [
+    linkErrorDrawer,
     teamOpen && /* @__PURE__ */ jsx(TeamDrawer, { onClose: () => setTeamOpen(false) }),
     /* @__PURE__ */ jsxs("div", { "data-guardrail": true, style: S.toolbar, children: [
       /* @__PURE__ */ jsx("span", { style: S.dot }),

package/dist/react/Admin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/Admin.tsx"],"sourcesContent":["\"use client\";\n\nimport React, { useActionState, useEffect, useState } from \"react\";\nimport { usePathname, useRouter } from \"next/navigation\";\nimport {\n  loginAction,\n  logoutAction,\n  setPasswordAction,\n  skipSetPasswordAction,\n} from \"../server/actions\";\nimport { useGRail } from \"./Provider\";\nimport { TeamDrawer } from \"./Team\";\nimport { CloseIcon, LogOutIcon, PeopleIcon } from \"./Icons\";\nimport { S, THEME_CSS, v } from \"./styles\";\nimport { GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS } from \"../core/defs\";\nimport type { ActionState, SetPasswordState } from \"../core/types\";\n\nconst initialState: ActionState = { email: \"\", password: \"\" };\nconst initialPasswordState: SetPasswordState = {};\n\n/**\n * Owns the theme stylesheet so every piece of chrome — the sign-in bar, the\n * toolbar, and the field popups portaled to <body> — picks up the same\n * light/dark variables from one place.\n */\nexport function GRailAdmin(props: { toolbarExtra?: React.ReactNode }) {\n  const { isEditMode } = useGRail();\n  if (!isEditMode) return null;\n  return (\n    <>\n      {/*\n        precedence + href make React hoist this into <head> and dedupe it.\n        Required, not cosmetic: this whole component renders as a sibling of\n        <html> (withGuardrail can't reach inside the app's own layout), and\n        React 19 rejects a bare <style> anywhere outside the main document.\n      */}\n      <style href=\"guardrail-theme\" precedence=\"default\">\n        {THEME_CSS}\n      </style>\n      <AdminBody {...props} />\n    </>\n  );\n}\n\nfunction AdminBody({ toolbarExtra }: { toolbarExtra?: React.ReactNode }) {\n  const { isAuth, isEditMode, needsPassword, role, auth } = useGRail();\n  const [teamOpen, setTeamOpen] = useState(false);\n  const [formState, formAction, isPending] = useActionState(\n    loginAction,\n    initialState,\n  );\n  const [passwordState, passwordFormAction, isSettingPassword] = useActionState(\n    setPasswordAction,\n    initialPasswordState,\n  );\n  const router = useRouter();\n  const pathname = usePathname();\n\n  useEffect(() => {\n    if (formState.success) router.refresh();\n  }, [formState.success, router]);\n\n  useEffect(() => {\n    if (passwordState.success) router.refresh();\n  }, [passwordState.success, router]);\n\n  const skipSetPassword = async () => {\n    await skipSetPasswordAction();\n    router.refresh();\n  };\n\n  // Ends the editing session, not the sign-in: the overlay goes away and the\n  // person's session stays, so ?edit=true brings it straight back with no\n  // credentials. The sign-in form only returns once the session itself is\n  // gone (expired, or ended elsewhere). Explicit \"false\" rather than deleting\n  // the cookie: with a live session, deleting it would leave edit mode on —\n  // see resolveEditMode. router.replace drops ?edit=true from the URL (a bare\n  // refresh would leave it there), and refresh re-renders without chrome.\n  //\n  // Also what the sign-in bar's dismiss button does, for someone who was never\n  // authenticated and doesn't want to be here at all.\n  const exitEditMode = () => {\n    document.cookie = `${GR_COOKIES.EDIT_MODE}=false; path=/; max-age=${GR_EDIT_MODE_OFF_TTL_SECONDS}; SameSite=Lax`;\n    router.replace(pathname);\n    router.refresh();\n  };\n\n  // A real sign-out, kept only for the \"no access\" bar below: someone on the\n  // wrong account has no other way to switch to the right one. logoutAction()\n  // clears the edit-mode cookie itself — a client-side navigation right after\n  // it used to race Next's own post-action route refresh and lose.\n  const signOut = async () => {\n    await logoutAction();\n    router.replace(pathname);\n    router.refresh();\n  };\n\n  // No intent signalled — render nothing at all.\n  if (!isEditMode) return null;\n\n  if (!isAuth) {\n    // The adapter cannot take a password here, so hand sign-in off rather than\n    // showing a form that could never succeed.\n    if (!auth.password) {\n      return (\n        <div data-guardrail style={S.banner}>\n          <div style={S.bannerForm}>\n            <div style={S.brandStack}>\n              <span style={S.brand}>Guardrail</span>\n              {!auth.signInUrl && (\n                <span style={{ fontSize: 12, color: v(\"muted\") }}>\n                  No sign-in method is configured for this site.\n                </span>\n              )}\n            </div>\n            {auth.signInUrl && (\n              <a href={auth.signInUrl} style={{ ...S.primaryBtn, textDecoration: \"none\" }}>\n                Sign in\n              </a>\n            )}\n            <button\n              type=\"button\"\n              style={{ ...S.iconBtn, color: v(\"muted\") }}\n              onClick={exitEditMode}\n              title=\"Not editing? Dismiss\"\n              aria-label=\"Dismiss\"\n            >\n              <CloseIcon />\n            </button>\n          </div>\n        </div>\n      );\n    }\n\n    return (\n      <div data-guardrail style={S.banner}>\n        <form action={formAction} style={S.bannerForm}>\n          <div style={S.brandStack}>\n            <span style={S.brand}>Guardrail</span>\n            {formState.error && <span style={S.error}>{formState.error}</span>}\n          </div>\n          <input\n            name=\"email\"\n            type=\"email\"\n            autoComplete=\"email\"\n            placeholder=\"Email\"\n            defaultValue={formState.email}\n            required\n            style={S.input}\n          />\n          <input\n            name=\"password\"\n            type=\"password\"\n            autoComplete=\"current-password\"\n            placeholder=\"Password\"\n            required\n            style={S.input}\n          />\n          <button type=\"submit\" disabled={isPending} style={S.primaryBtn}>\n            {isPending ? \"Authenticating…\" : \"Sign In\"}\n          </button>\n          <button\n            type=\"button\"\n            style={{ ...S.iconBtn, color: v(\"muted\") }}\n            onClick={exitEditMode}\n            title=\"Not editing? Dismiss\"\n            aria-label=\"Dismiss\"\n          >\n            <CloseIcon />\n          </button>\n        </form>\n      </div>\n    );\n  }\n\n  // A redirect-carried session (an invite or password-recovery link) just\n  // completed — they're genuinely signed in, but have no password yet.\n  // Ahead of the role check below: getCachedViewer() already claims a\n  // pending invite as a side effect of resolving them, so role is normally\n  // already set by the time this renders — this is purely about the\n  // password, which is orthogonal to that. Skippable rather than a hard\n  // gate: magic-link sign-in already works with no password at all, so\n  // someone can dismiss this and keep using invite/magic links indefinitely.\n  if (needsPassword) {\n    return (\n      <div data-guardrail style={S.banner}>\n        <form action={passwordFormAction} style={S.bannerForm}>\n          <div style={S.brandStack}>\n            <span style={S.brand}>Guardrail</span>\n            {passwordState.error ? (\n              <span style={S.error}>{passwordState.error}</span>\n            ) : (\n              <span style={{ fontSize: 12, color: v(\"muted\") }}>\n                Set a password to sign in next time\n              </span>\n            )}\n          </div>\n          <input\n            name=\"password\"\n            type=\"password\"\n            placeholder=\"New password\"\n            required\n            minLength={6}\n            style={S.input}\n          />\n          <button type=\"submit\" disabled={isSettingPassword} style={S.primaryBtn}>\n            {isSettingPassword ? \"Saving…\" : \"Set Password\"}\n          </button>\n          <button\n            type=\"button\"\n            style={{ ...S.iconBtn, color: v(\"muted\") }}\n            onClick={skipSetPassword}\n            title=\"Skip for now\"\n            aria-label=\"Skip\"\n          >\n            <CloseIcon />\n          </button>\n        </form>\n      </div>\n    );\n  }\n\n  // Signed in, but holds no role on this site.\n  if (!role) {\n    return (\n      <div data-guardrail style={S.toolbar}>\n        <span style={S.toolbarLabel}>No access to this site</span>\n        <span style={S.divider} />\n        <button\n          style={{ ...S.iconBtn, color: v(\"muted\") }}\n          onClick={signOut}\n          title=\"Sign out\"\n          aria-label=\"Sign out\"\n        >\n          <LogOutIcon />\n        </button>\n      </div>\n    );\n  }\n\n  return (\n    <>\n      {teamOpen && <TeamDrawer onClose={() => setTeamOpen(false)} />}\n      <div data-guardrail style={S.toolbar}>\n        <span style={S.dot} />\n        <span style={S.toolbarLabel}>Edit Mode</span>\n        <span style={S.divider} />\n        <button\n          style={{ ...S.iconBtn, color: v(\"muted\"), width: 24, height: 24 }}\n          onClick={() => setTeamOpen(true)}\n          title=\"Team\"\n          aria-label=\"Team\"\n        >\n          <PeopleIcon />\n        </button>\n\n        {toolbarExtra && (\n          <>\n            <span style={S.divider} />\n            {toolbarExtra}\n          </>\n        )}\n\n        <span style={S.divider} />\n        <button\n          style={{ ...S.iconBtn, color: v(\"muted\") }}\n          onClick={exitEditMode}\n          title=\"Exit edit mode\"\n          aria-label=\"Exit edit mode\"\n        >\n          <LogOutIcon />\n        </button>\n      </div>\n    </>\n  );\n}\n"],"mappings":";AA6BI,mBAOE,KAPF;AA3BJ,OAAO,SAAS,gBAAgB,WAAW,gBAAgB;AAC3D,SAAS,aAAa,iBAAiB;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,WAAW,YAAY,kBAAkB;AAClD,SAAS,GAAG,WAAW,SAAS;AAChC,SAAS,YAAY,oCAAoC;AAGzD,MAAM,eAA4B,EAAE,OAAO,IAAI,UAAU,GAAG;AAC5D,MAAM,uBAAyC,CAAC;AAOzC,SAAS,WAAW,OAA2C;AACpE,QAAM,EAAE,WAAW,IAAI,SAAS;AAChC,MAAI,CAAC,WAAY,QAAO;AACxB,SACE,iCAOE;AAAA,wBAAC,WAAM,MAAK,mBAAkB,YAAW,WACtC,qBACH;AAAA,IACA,oBAAC,aAAW,GAAG,OAAO;AAAA,KACxB;AAEJ;AAEA,SAAS,UAAU,EAAE,aAAa,GAAuC;AACvE,QAAM,EAAE,QAAQ,YAAY,eAAe,MAAM,KAAK,IAAI,SAAS;AACnE,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,KAAK;AAC9C,QAAM,CAAC,WAAW,YAAY,SAAS,IAAI;AAAA,IACzC;AAAA,IACA;AAAA,EACF;AACA,QAAM,CAAC,eAAe,oBAAoB,iBAAiB,IAAI;AAAA,IAC7D;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,UAAU;AACzB,QAAM,WAAW,YAAY;AAE7B,YAAU,MAAM;AACd,QAAI,UAAU,QAAS,QAAO,QAAQ;AAAA,EACxC,GAAG,CAAC,UAAU,SAAS,MAAM,CAAC;AAE9B,YAAU,MAAM;AACd,QAAI,cAAc,QAAS,QAAO,QAAQ;AAAA,EAC5C,GAAG,CAAC,cAAc,SAAS,MAAM,CAAC;AAElC,QAAM,kBAAkB,YAAY;AAClC,UAAM,sBAAsB;AAC5B,WAAO,QAAQ;AAAA,EACjB;AAYA,QAAM,eAAe,MAAM;AACzB,aAAS,SAAS,GAAG,WAAW,SAAS,2BAA2B,4BAA4B;AAChG,WAAO,QAAQ,QAAQ;AACvB,WAAO,QAAQ;AAAA,EACjB;AAMA,QAAM,UAAU,YAAY;AAC1B,UAAM,aAAa;AACnB,WAAO,QAAQ,QAAQ;AACvB,WAAO,QAAQ;AAAA,EACjB;AAGA,MAAI,CAAC,WAAY,QAAO;AAExB,MAAI,CAAC,QAAQ;AAGX,QAAI,CAAC,KAAK,UAAU;AAClB,aACE,oBAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,QAC3B,+BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,6BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,8BAAC,UAAK,OAAO,EAAE,OAAO,uBAAS;AAAA,UAC9B,CAAC,KAAK,aACL,oBAAC,UAAK,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,GAAG,4DAElD;AAAA,WAEJ;AAAA,QACC,KAAK,aACJ,oBAAC,OAAE,MAAM,KAAK,WAAW,OAAO,EAAE,GAAG,EAAE,YAAY,gBAAgB,OAAO,GAAG,qBAE7E;AAAA,QAEF;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,YACzC,SAAS;AAAA,YACT,OAAM;AAAA,YACN,cAAW;AAAA,YAEX,8BAAC,aAAU;AAAA;AAAA,QACb;AAAA,SACF,GACF;AAAA,IAEJ;AAEA,WACE,oBAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,QAC3B,+BAAC,UAAK,QAAQ,YAAY,OAAO,EAAE,YACjC;AAAA,2BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,4BAAC,UAAK,OAAO,EAAE,OAAO,uBAAS;AAAA,QAC9B,UAAU,SAAS,oBAAC,UAAK,OAAO,EAAE,OAAQ,oBAAU,OAAM;AAAA,SAC7D;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,cAAa;AAAA,UACb,aAAY;AAAA,UACZ,cAAc,UAAU;AAAA,UACxB,UAAQ;AAAA,UACR,OAAO,EAAE;AAAA;AAAA,MACX;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,cAAa;AAAA,UACb,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,OAAO,EAAE;AAAA;AAAA,MACX;AAAA,MACA,oBAAC,YAAO,MAAK,UAAS,UAAU,WAAW,OAAO,EAAE,YACjD,sBAAY,yBAAoB,WACnC;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,UACzC,SAAS;AAAA,UACT,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,aAAU;AAAA;AAAA,MACb;AAAA,OACF,GACF;AAAA,EAEJ;AAUA,MAAI,eAAe;AACjB,WACE,oBAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,QAC3B,+BAAC,UAAK,QAAQ,oBAAoB,OAAO,EAAE,YACzC;AAAA,2BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,4BAAC,UAAK,OAAO,EAAE,OAAO,uBAAS;AAAA,QAC9B,cAAc,QACb,oBAAC,UAAK,OAAO,EAAE,OAAQ,wBAAc,OAAM,IAE3C,oBAAC,UAAK,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,GAAG,iDAElD;AAAA,SAEJ;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,MAAK;AAAA,UACL,aAAY;AAAA,UACZ,UAAQ;AAAA,UACR,WAAW;AAAA,UACX,OAAO,EAAE;AAAA;AAAA,MACX;AAAA,MACA,oBAAC,YAAO,MAAK,UAAS,UAAU,mBAAmB,OAAO,EAAE,YACzD,8BAAoB,iBAAY,gBACnC;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,UACzC,SAAS;AAAA,UACT,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,aAAU;AAAA;AAAA,MACb;AAAA,OACF,GACF;AAAA,EAEJ;AAGA,MAAI,CAAC,MAAM;AACT,WACE,qBAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,SAC3B;AAAA,0BAAC,UAAK,OAAO,EAAE,cAAc,oCAAsB;AAAA,MACnD,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,MACxB;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,UACzC,SAAS;AAAA,UACT,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,iCACG;AAAA,gBAAY,oBAAC,cAAW,SAAS,MAAM,YAAY,KAAK,GAAG;AAAA,IAC5D,qBAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,SAC3B;AAAA,0BAAC,UAAK,OAAO,EAAE,KAAK;AAAA,MACpB,oBAAC,UAAK,OAAO,EAAE,cAAc,uBAAS;AAAA,MACtC,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,MACxB;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AAAA,UAChE,SAAS,MAAM,YAAY,IAAI;AAAA,UAC/B,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,MAEC,gBACC,iCACE;AAAA,4BAAC,UAAK,OAAO,EAAE,SAAS;AAAA,QACvB;AAAA,SACH;AAAA,MAGF,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,MACxB;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,UACzC,SAAS;AAAA,UACT,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,OACF;AAAA,KACF;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/react/Admin.tsx"],"sourcesContent":["\"use client\";\n\nimport React, { useActionState, useEffect, useState } from \"react\";\nimport { usePathname, useRouter } from \"next/navigation\";\nimport { loginAction, logoutAction } from \"../server/actions\";\nimport { useGRail } from \"./Provider\";\nimport { TeamDrawer } from \"./Team\";\nimport { AuthDrawer } from \"./AuthDrawer\";\nimport { CloseIcon, LogOutIcon, PeopleIcon } from \"./Icons\";\nimport { S, THEME_CSS, v } from \"./styles\";\nimport { GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS } from \"../core/defs\";\nimport type { ActionState } from \"../core/types\";\n\nconst initialState: ActionState = { email: \"\", password: \"\" };\n\n/**\n * Owns the theme stylesheet so every piece of chrome — the sign-in bar, the\n * toolbar, and the field popups portaled to <body> — picks up the same\n * light/dark variables from one place.\n */\nexport function GRailAdmin(props: { toolbarExtra?: React.ReactNode }) {\n  const { isEditMode } = useGRail();\n  if (!isEditMode) return null;\n  return (\n    <>\n      {/*\n        precedence + href make React hoist this into <head> and dedupe it.\n        Required, not cosmetic: this whole component renders as a sibling of\n        <html> (withGuardrail can't reach inside the app's own layout), and\n        React 19 rejects a bare <style> anywhere outside the main document.\n      */}\n      <style href=\"guardrail-theme\" precedence=\"default\">\n        {THEME_CSS}\n      </style>\n      <AdminBody {...props} />\n    </>\n  );\n}\n\nfunction AdminBody({ toolbarExtra }: { toolbarExtra?: React.ReactNode }) {\n  const { isAuth, isEditMode, needsPassword, authError, role, auth } = useGRail();\n  const [teamOpen, setTeamOpen] = useState(false);\n  const [forgotOpen, setForgotOpen] = useState(false);\n  const [errorDismissed, setErrorDismissed] = useState(false);\n  const [formState, formAction, isPending] = useActionState(\n    loginAction,\n    initialState,\n  );\n  const router = useRouter();\n  const pathname = usePathname();\n\n  useEffect(() => {\n    if (formState.success) router.refresh();\n  }, [formState.success, router]);\n\n  // The message for an emailed link that didn't work. The cookie behind it is\n  // read on the server, so dismissing clears it there too (and refreshes), but\n  // hides it right away without waiting for that.\n  const dismissAuthError = () => {\n    document.cookie = `${GR_COOKIES.AUTH_ERROR}=; path=/; max-age=0; SameSite=Lax`;\n    setErrorDismissed(true);\n    router.refresh();\n  };\n  const linkErrorDrawer =\n    authError && !errorDismissed ? (\n      <AuthDrawer\n        mode=\"forgot\"\n        title=\"That link didn't work\"\n        message={\n          authError === \"expired\"\n            ? \"It has expired or was already used. Links work once. Enter your email to get a new one.\"\n            : \"We couldn't complete it. Enter your email to get a new link.\"\n        }\n        onClose={dismissAuthError}\n      />\n    ) : null;\n\n  // Ends the editing session, not the sign-in: the overlay goes away and the\n  // person's session stays, so ?edit=true brings it straight back with no\n  // credentials. The sign-in form only returns once the session itself is\n  // gone (expired, or ended elsewhere). Explicit \"false\" rather than deleting\n  // the cookie: with a live session, deleting it would leave edit mode on —\n  // see resolveEditMode. router.replace drops ?edit=true from the URL (a bare\n  // refresh would leave it there), and refresh re-renders without chrome.\n  //\n  // Also what the sign-in bar's dismiss button does, for someone who was never\n  // authenticated and doesn't want to be here at all.\n  const exitEditMode = () => {\n    document.cookie = `${GR_COOKIES.EDIT_MODE}=false; path=/; max-age=${GR_EDIT_MODE_OFF_TTL_SECONDS}; SameSite=Lax`;\n    router.replace(pathname);\n    router.refresh();\n  };\n\n  // A real sign-out, kept only for the \"no access\" bar below: someone on the\n  // wrong account has no other way to switch to the right one. logoutAction()\n  // clears the edit-mode cookie itself — a client-side navigation right after\n  // it used to race Next's own post-action route refresh and lose.\n  const signOut = async () => {\n    await logoutAction();\n    router.replace(pathname);\n    router.refresh();\n  };\n\n  // No intent signalled — render nothing at all.\n  if (!isEditMode) return null;\n\n  if (!isAuth) {\n    // The adapter cannot take a password here, so hand sign-in off rather than\n    // showing a form that could never succeed.\n    if (!auth.password) {\n      return (\n        <>\n          <div data-guardrail style={S.banner}>\n            <div style={S.bannerForm}>\n              <div style={S.brandStack}>\n                <span style={S.brand}>Guardrail</span>\n                {!auth.signInUrl && (\n                  <span style={{ fontSize: 12, color: v(\"muted\") }}>\n                    No sign-in method is configured for this site.\n                  </span>\n                )}\n              </div>\n              {auth.signInUrl && (\n                <a href={auth.signInUrl} style={{ ...S.primaryBtn, textDecoration: \"none\" }}>\n                  Sign in\n                </a>\n              )}\n              <button\n                type=\"button\"\n                style={{ ...S.iconBtn, color: v(\"muted\") }}\n                onClick={exitEditMode}\n                title=\"Not editing? Dismiss\"\n                aria-label=\"Dismiss\"\n              >\n                <CloseIcon />\n              </button>\n            </div>\n          </div>\n          {linkErrorDrawer}\n        </>\n      );\n    }\n\n    return (\n      <>\n        <div data-guardrail style={S.banner}>\n          <form action={formAction} style={S.bannerForm}>\n            <div style={S.brandStack}>\n              <span style={S.brand}>Guardrail</span>\n              {formState.error && <span style={S.error}>{formState.error}</span>}\n            </div>\n            <input\n              name=\"email\"\n              type=\"email\"\n              autoComplete=\"email\"\n              placeholder=\"Email\"\n              defaultValue={formState.email}\n              required\n              style={S.input}\n            />\n            <input\n              name=\"password\"\n              type=\"password\"\n              autoComplete=\"current-password\"\n              placeholder=\"Password\"\n              required\n              style={S.input}\n            />\n            <button type=\"submit\" disabled={isPending} style={S.primaryBtn}>\n              {isPending ? \"Authenticating…\" : \"Sign In\"}\n            </button>\n            <button\n              type=\"button\"\n              onClick={() => setForgotOpen(true)}\n              style={{\n                background: \"none\",\n                border: \"none\",\n                cursor: \"pointer\",\n                color: v(\"muted\"),\n                fontSize: 12,\n                textDecoration: \"underline\",\n                padding: \"0 4px\",\n                whiteSpace: \"nowrap\",\n              }}\n            >\n              Forgot password?\n            </button>\n            <button\n              type=\"button\"\n              style={{ ...S.iconBtn, color: v(\"muted\") }}\n              onClick={exitEditMode}\n              title=\"Not editing? Dismiss\"\n              aria-label=\"Dismiss\"\n            >\n              <CloseIcon />\n            </button>\n          </form>\n        </div>\n        {linkErrorDrawer ??\n          (forgotOpen && <AuthDrawer mode=\"forgot\" onClose={() => setForgotOpen(false)} />)}\n      </>\n    );\n  }\n\n  // An invite or password-reset link just completed: they're signed in, but must\n  // choose a password before anything else. Ahead of the role check below —\n  // getCachedViewer() already claims a pending invite as a side effect of\n  // resolving them, so the role is normally set by now; this is purely about the\n  // password. Not skippable: a password is the only way back in once this\n  // session ends, so the overlay and toolbar wait until one exists.\n  if (needsPassword) return <AuthDrawer mode=\"set-password\" />;\n\n  // Signed in, but holds no role on this site.\n  if (!role) {\n    return (\n      <>\n        <div data-guardrail style={S.toolbar}>\n          <span style={S.toolbarLabel}>No access to this site</span>\n          <span style={S.divider} />\n          <button\n            style={{ ...S.iconBtn, color: v(\"muted\") }}\n            onClick={signOut}\n            title=\"Sign out\"\n            aria-label=\"Sign out\"\n          >\n            <LogOutIcon />\n          </button>\n        </div>\n        {linkErrorDrawer}\n      </>\n    );\n  }\n\n  return (\n    <>\n      {linkErrorDrawer}\n      {teamOpen && <TeamDrawer onClose={() => setTeamOpen(false)} />}\n      <div data-guardrail style={S.toolbar}>\n        <span style={S.dot} />\n        <span style={S.toolbarLabel}>Edit Mode</span>\n        <span style={S.divider} />\n        <button\n          style={{ ...S.iconBtn, color: v(\"muted\"), width: 24, height: 24 }}\n          onClick={() => setTeamOpen(true)}\n          title=\"Team\"\n          aria-label=\"Team\"\n        >\n          <PeopleIcon />\n        </button>\n\n        {toolbarExtra && (\n          <>\n            <span style={S.divider} />\n            {toolbarExtra}\n          </>\n        )}\n\n        <span style={S.divider} />\n        <button\n          style={{ ...S.iconBtn, color: v(\"muted\") }}\n          onClick={exitEditMode}\n          title=\"Exit edit mode\"\n          aria-label=\"Exit edit mode\"\n        >\n          <LogOutIcon />\n        </button>\n      </div>\n    </>\n  );\n}\n"],"mappings":";AAwBI,mBAOE,KAPF;AAtBJ,OAAO,SAAS,gBAAgB,WAAW,gBAAgB;AAC3D,SAAS,aAAa,iBAAiB;AACvC,SAAS,aAAa,oBAAoB;AAC1C,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,WAAW,YAAY,kBAAkB;AAClD,SAAS,GAAG,WAAW,SAAS;AAChC,SAAS,YAAY,oCAAoC;AAGzD,MAAM,eAA4B,EAAE,OAAO,IAAI,UAAU,GAAG;AAOrD,SAAS,WAAW,OAA2C;AACpE,QAAM,EAAE,WAAW,IAAI,SAAS;AAChC,MAAI,CAAC,WAAY,QAAO;AACxB,SACE,iCAOE;AAAA,wBAAC,WAAM,MAAK,mBAAkB,YAAW,WACtC,qBACH;AAAA,IACA,oBAAC,aAAW,GAAG,OAAO;AAAA,KACxB;AAEJ;AAEA,SAAS,UAAU,EAAE,aAAa,GAAuC;AACvE,QAAM,EAAE,QAAQ,YAAY,eAAe,WAAW,MAAM,KAAK,IAAI,SAAS;AAC9E,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,KAAK;AAC9C,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAS,KAAK;AAC1D,QAAM,CAAC,WAAW,YAAY,SAAS,IAAI;AAAA,IACzC;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,UAAU;AACzB,QAAM,WAAW,YAAY;AAE7B,YAAU,MAAM;AACd,QAAI,UAAU,QAAS,QAAO,QAAQ;AAAA,EACxC,GAAG,CAAC,UAAU,SAAS,MAAM,CAAC;AAK9B,QAAM,mBAAmB,MAAM;AAC7B,aAAS,SAAS,GAAG,WAAW,UAAU;AAC1C,sBAAkB,IAAI;AACtB,WAAO,QAAQ;AAAA,EACjB;AACA,QAAM,kBACJ,aAAa,CAAC,iBACZ;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,OAAM;AAAA,MACN,SACE,cAAc,YACV,4FACA;AAAA,MAEN,SAAS;AAAA;AAAA,EACX,IACE;AAYN,QAAM,eAAe,MAAM;AACzB,aAAS,SAAS,GAAG,WAAW,SAAS,2BAA2B,4BAA4B;AAChG,WAAO,QAAQ,QAAQ;AACvB,WAAO,QAAQ;AAAA,EACjB;AAMA,QAAM,UAAU,YAAY;AAC1B,UAAM,aAAa;AACnB,WAAO,QAAQ,QAAQ;AACvB,WAAO,QAAQ;AAAA,EACjB;AAGA,MAAI,CAAC,WAAY,QAAO;AAExB,MAAI,CAAC,QAAQ;AAGX,QAAI,CAAC,KAAK,UAAU;AAClB,aACE,iCACE;AAAA,4BAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,QAC3B,+BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,+BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,gCAAC,UAAK,OAAO,EAAE,OAAO,uBAAS;AAAA,YAC9B,CAAC,KAAK,aACL,oBAAC,UAAK,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,GAAG,4DAElD;AAAA,aAEJ;AAAA,UACC,KAAK,aACJ,oBAAC,OAAE,MAAM,KAAK,WAAW,OAAO,EAAE,GAAG,EAAE,YAAY,gBAAgB,OAAO,GAAG,qBAE7E;AAAA,UAEF;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,cACzC,SAAS;AAAA,cACT,OAAM;AAAA,cACN,cAAW;AAAA,cAEX,8BAAC,aAAU;AAAA;AAAA,UACb;AAAA,WACF,GACF;AAAA,QACC;AAAA,SACH;AAAA,IAEJ;AAEA,WACE,iCACE;AAAA,0BAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,QAC3B,+BAAC,UAAK,QAAQ,YAAY,OAAO,EAAE,YACjC;AAAA,6BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,8BAAC,UAAK,OAAO,EAAE,OAAO,uBAAS;AAAA,UAC9B,UAAU,SAAS,oBAAC,UAAK,OAAO,EAAE,OAAQ,oBAAU,OAAM;AAAA,WAC7D;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAY;AAAA,YACZ,cAAc,UAAU;AAAA,YACxB,UAAQ;AAAA,YACR,OAAO,EAAE;AAAA;AAAA,QACX;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAY;AAAA,YACZ,UAAQ;AAAA,YACR,OAAO,EAAE;AAAA;AAAA,QACX;AAAA,QACA,oBAAC,YAAO,MAAK,UAAS,UAAU,WAAW,OAAO,EAAE,YACjD,sBAAY,yBAAoB,WACnC;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAS,MAAM,cAAc,IAAI;AAAA,YACjC,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,OAAO,EAAE,OAAO;AAAA,cAChB,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,SAAS;AAAA,cACT,YAAY;AAAA,YACd;AAAA,YACD;AAAA;AAAA,QAED;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,YACzC,SAAS;AAAA,YACT,OAAM;AAAA,YACN,cAAW;AAAA,YAEX,8BAAC,aAAU;AAAA;AAAA,QACb;AAAA,SACF,GACF;AAAA,MACC,oBACE,cAAc,oBAAC,cAAW,MAAK,UAAS,SAAS,MAAM,cAAc,KAAK,GAAG;AAAA,OAClF;AAAA,EAEJ;AAQA,MAAI,cAAe,QAAO,oBAAC,cAAW,MAAK,gBAAe;AAG1D,MAAI,CAAC,MAAM;AACT,WACE,iCACE;AAAA,2BAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,SAC3B;AAAA,4BAAC,UAAK,OAAO,EAAE,cAAc,oCAAsB;AAAA,QACnD,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,QACxB;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,YACzC,SAAS;AAAA,YACT,OAAM;AAAA,YACN,cAAW;AAAA,YAEX,8BAAC,cAAW;AAAA;AAAA,QACd;AAAA,SACF;AAAA,MACC;AAAA,OACH;AAAA,EAEJ;AAEA,SACE,iCACG;AAAA;AAAA,IACA,YAAY,oBAAC,cAAW,SAAS,MAAM,YAAY,KAAK,GAAG;AAAA,IAC5D,qBAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,SAC3B;AAAA,0BAAC,UAAK,OAAO,EAAE,KAAK;AAAA,MACpB,oBAAC,UAAK,OAAO,EAAE,cAAc,uBAAS;AAAA,MACtC,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,MACxB;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AAAA,UAChE,SAAS,MAAM,YAAY,IAAI;AAAA,UAC/B,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,MAEC,gBACC,iCACE;AAAA,4BAAC,UAAK,OAAO,EAAE,SAAS;AAAA,QACvB;AAAA,SACH;AAAA,MAGF,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,MACxB;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,UACzC,SAAS;AAAA,UACT,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,OACF;AAAA,KACF;AAEJ;","names":[]}

package/dist/react/AuthDrawer.d.ts

@@ -0,0 +1,23 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+
+/**
+ * The two password steps, in the same drawer the Team panel uses.
+ *
+ * Guardrail asks people for one credential, a password. Emailed links exist only
+ * to let someone choose or replace it, so this is where they land:
+ *
+ *  - "set-password" — after an invite or reset link. Cannot be dismissed: until a
+ *    password exists there is nothing to sign in with next time. The one way out
+ *    is to sign out.
+ *  - "forgot" — asks for an address and emails a reset link. Opened from the
+ *    sign-in bar, and from the "that link didn't work" message with `message`.
+ */
+declare function AuthDrawer({ mode, title, message, onClose, }: {
+    mode: "set-password" | "forgot";
+    title?: string;
+    /** Plain-language context shown above the form, e.g. why a link failed. */
+    message?: string;
+    onClose?: () => void;
+}): react_jsx_runtime.JSX.Element;
+
+export { AuthDrawer };

package/dist/react/AuthDrawer.js

@@ -0,0 +1,165 @@
+"use client";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import React, { useActionState, useEffect, useState, useTransition } from "react";
+import { useRouter } from "next/navigation";
+import { forgotPasswordAction, logoutAction, setPasswordAction } from "../server/actions";
+import { CloseIcon } from "./Icons";
+import { S, v } from "./styles";
+import { ANIMATION_CSS } from "./Team";
+const initialPasswordState = {};
+function AuthDrawer({
+  mode,
+  title,
+  message,
+  onClose
+}) {
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsx("style", { href: "guardrail-team-animation", precedence: "default", children: ANIMATION_CSS }),
+    /* @__PURE__ */ jsx(
+      "div",
+      {
+        "data-guardrail": true,
+        "data-guardrail-scrim": true,
+        style: S.scrim,
+        onClick: mode === "forgot" ? onClose : void 0
+      }
+    ),
+    /* @__PURE__ */ jsxs(
+      "aside",
+      {
+        "data-guardrail": true,
+        "data-guardrail-team": true,
+        style: S.drawer,
+        role: "dialog",
+        "aria-label": mode === "set-password" ? "Set your password" : "Forgot password",
+        children: [
+          /* @__PURE__ */ jsxs("header", { style: S.drawerHead, children: [
+            /* @__PURE__ */ jsx("h2", { style: S.drawerTitle, children: title ?? (mode === "set-password" ? "Set your password" : "Forgot your password?") }),
+            mode === "forgot" && onClose && /* @__PURE__ */ jsx("button", { style: { ...S.iconBtn, color: v("muted") }, onClick: onClose, "aria-label": "Close", children: /* @__PURE__ */ jsx(CloseIcon, {}) })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { style: S.drawerBody, children: [
+            message && /* @__PURE__ */ jsx("p", { style: { fontSize: 13, lineHeight: 1.5, margin: "0 0 16px", color: v("fg") }, children: message }),
+            mode === "set-password" ? /* @__PURE__ */ jsx(SetPasswordForm, {}) : /* @__PURE__ */ jsx(ForgotPasswordForm, {})
+          ] })
+        ]
+      }
+    )
+  ] });
+}
+function SetPasswordForm() {
+  const router = useRouter();
+  const [state, formAction, isPending] = useActionState(setPasswordAction, initialPasswordState);
+  const [signingOut, startSignOut] = useTransition();
+  useEffect(() => {
+    if (state.success) router.refresh();
+  }, [state.success, router]);
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsx("p", { style: { fontSize: 13, lineHeight: 1.5, margin: "0 0 16px", color: v("muted") }, children: "Choose a password. It's how you'll sign in from now on." }),
+    /* @__PURE__ */ jsxs("form", { action: formAction, children: [
+      /* @__PURE__ */ jsx("label", { style: S.label, htmlFor: "gr-new-password", children: "New password" }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          id: "gr-new-password",
+          style: S.field,
+          name: "password",
+          type: "password",
+          autoComplete: "new-password",
+          minLength: 8,
+          required: true,
+          autoFocus: true
+        }
+      ),
+      /* @__PURE__ */ jsx("label", { style: S.label, htmlFor: "gr-confirm-password", children: "Confirm password" }),
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          id: "gr-confirm-password",
+          style: S.field,
+          name: "confirm",
+          type: "password",
+          autoComplete: "new-password",
+          minLength: 8,
+          required: true
+        }
+      ),
+      /* @__PURE__ */ jsx("p", { style: { fontSize: 11, color: v("subtle"), margin: "0 0 12px" }, children: "At least 8 characters." }),
+      state.error && /* @__PURE__ */ jsx("div", { style: { ...S.error, marginBottom: 12 }, children: state.error }),
+      /* @__PURE__ */ jsx("button", { style: { ...S.primaryBtn, width: "100%" }, type: "submit", disabled: isPending || signingOut, children: isPending ? "Saving\u2026" : "Set password" })
+    ] }),
+    /* @__PURE__ */ jsx(
+      "button",
+      {
+        type: "button",
+        disabled: isPending || signingOut,
+        style: {
+          background: "none",
+          border: "none",
+          cursor: "pointer",
+          color: v("muted"),
+          fontSize: 12,
+          textDecoration: "underline",
+          padding: 0,
+          marginTop: 16
+        },
+        onClick: () => startSignOut(async () => {
+          await logoutAction();
+          router.refresh();
+        }),
+        children: "Cancel and sign out"
+      }
+    )
+  ] });
+}
+function ForgotPasswordForm() {
+  const [email, setEmail] = useState("");
+  const [status, setStatus] = useState("idle");
+  const [error, setError] = useState(null);
+  if (status === "sent") {
+    return /* @__PURE__ */ jsxs("p", { style: { fontSize: 13, lineHeight: 1.5, margin: 0, color: v("fg") }, children: [
+      "If ",
+      /* @__PURE__ */ jsx("strong", { children: email.trim() }),
+      " has access to this site, a link to choose a new password is on its way. It works once, so open it on this device."
+    ] });
+  }
+  return /* @__PURE__ */ jsxs(
+    "form",
+    {
+      onSubmit: async (e) => {
+        e.preventDefault();
+        setStatus("sending");
+        setError(null);
+        const res = await forgotPasswordAction(email);
+        if (res.success) setStatus("sent");
+        else {
+          setError(res.error ?? "Something went wrong.");
+          setStatus("idle");
+        }
+      },
+      children: [
+        /* @__PURE__ */ jsx("p", { style: { fontSize: 13, lineHeight: 1.5, margin: "0 0 16px", color: v("muted") }, children: "Enter your email and we'll send a link to choose a new password." }),
+        /* @__PURE__ */ jsx("label", { style: S.label, htmlFor: "gr-forgot-email", children: "Email" }),
+        /* @__PURE__ */ jsx(
+          "input",
+          {
+            id: "gr-forgot-email",
+            style: S.field,
+            type: "email",
+            autoComplete: "email",
+            placeholder: "name@company.com",
+            value: email,
+            onChange: (e) => setEmail(e.target.value),
+            required: true,
+            autoFocus: true
+          }
+        ),
+        error && /* @__PURE__ */ jsx("div", { style: { ...S.error, marginBottom: 12 }, children: error }),
+        /* @__PURE__ */ jsx("button", { style: { ...S.primaryBtn, width: "100%" }, type: "submit", disabled: status === "sending", children: status === "sending" ? "Sending\u2026" : "Send reset link" })
+      ]
+    }
+  );
+}
+export {
+  AuthDrawer
+};
+//# sourceMappingURL=AuthDrawer.js.map