@guard-rail/core 0.9.0 → 0.10.0

package/dist/core/validate.js

@@ -0,0 +1,118 @@
+const OVERRIDE_TYPES = ["text", "link", "image", "button"];
+const LIMITS = {
+  pathKey: 200,
+  text: 2e4,
+  url: 2048,
+  alt: 1e3,
+  dimension: 2e4
+};
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+const SCHEME = /^([a-z][a-z0-9+.\-]*):/i;
+const LINK_SCHEMES = ["http", "https", "mailto", "tel"];
+const IMAGE_SCHEMES = ["http", "https"];
+function allowedUrl(raw, schemes) {
+  if (typeof raw !== "string") return null;
+  const value = raw.trim();
+  if (!value || value.length > LIMITS.url || CONTROL_CHARS.test(value)) return null;
+  const scheme = value.replace(/\s/g, "").match(SCHEME)?.[1]?.toLowerCase();
+  if (scheme && !schemes.includes(scheme)) return null;
+  return value;
+}
+function safeHref(raw) {
+  return allowedUrl(raw, LINK_SCHEMES);
+}
+function safeImageSrc(raw) {
+  return allowedUrl(raw, IMAGE_SCHEMES);
+}
+function validPathKey(raw) {
+  if (typeof raw !== "string") return null;
+  const key = raw.trim();
+  return key && key.length <= LIMITS.pathKey && !CONTROL_CHARS.test(key) ? key : null;
+}
+function validateOverrideValue(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return { ok: false, error: "Invalid value." };
+  }
+  const v = input;
+  if (typeof v.type !== "string" || !OVERRIDE_TYPES.includes(v.type)) {
+    return { ok: false, error: `Unknown field type "${String(v.type)}".` };
+  }
+  const out = { type: v.type };
+  if (v.text !== void 0) {
+    if (typeof v.text !== "string" || v.text.length > LIMITS.text) {
+      return { ok: false, error: `Text must be a string under ${LIMITS.text} characters.` };
+    }
+    out.text = v.text;
+  }
+  if (v.alt !== void 0) {
+    if (typeof v.alt !== "string" || v.alt.length > LIMITS.alt) {
+      return { ok: false, error: `Alt text must be under ${LIMITS.alt} characters.` };
+    }
+    out.alt = v.alt;
+  }
+  if (v.href !== void 0 && v.href !== "") {
+    const href = safeHref(v.href);
+    if (href === null) {
+      return {
+        ok: false,
+        error: "That link isn't allowed. Use a path like /about, or an http(s), mailto or tel address."
+      };
+    }
+    out.href = href;
+  } else if (v.href === "") {
+    out.href = "";
+  }
+  if (v.src !== void 0 && v.src !== "") {
+    const src = safeImageSrc(v.src);
+    if (src === null) {
+      return { ok: false, error: "That image address isn't allowed. Use a path or an http(s) URL." };
+    }
+    out.src = src;
+  } else if (v.src === "") {
+    out.src = "";
+  }
+  for (const key of ["width", "height"]) {
+    const n = v[key];
+    if (n === void 0) continue;
+    if (typeof n !== "number" || !Number.isFinite(n) || n <= 0 || n > LIMITS.dimension) {
+      return { ok: false, error: `Image ${key} is out of range.` };
+    }
+    out[key] = Math.round(n);
+  }
+  return { ok: true, value: out };
+}
+const EMAIL_PATTERN = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+function cleanEmail(raw) {
+  if (typeof raw !== "string") return null;
+  const email = raw.trim().toLowerCase();
+  return email.length <= 254 && !CONTROL_CHARS.test(email) && EMAIL_PATTERN.test(email) ? email : null;
+}
+function isRole(raw) {
+  return raw === "admin" || raw === "editor";
+}
+function validId(raw) {
+  return typeof raw === "string" && raw.length > 0 && raw.length <= LIMITS.pathKey && !CONTROL_CHARS.test(raw) ? raw : null;
+}
+function validIdList(raw, max = 1e3) {
+  if (!Array.isArray(raw) || raw.length > max) return null;
+  const out = [];
+  for (const item of raw) {
+    const id = validId(item);
+    if (id === null) return null;
+    out.push(id);
+  }
+  return out;
+}
+export {
+  LIMITS,
+  OVERRIDE_TYPES,
+  cleanEmail,
+  isRole,
+  safeHref,
+  safeImageSrc,
+  validId,
+  validIdList,
+  validPathKey,
+  validateOverrideValue
+};
+//# sourceMappingURL=validate.js.map

package/dist/core/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/validate.ts"],"sourcesContent":["import type { GRRole, OverrideType, OverrideValue } from \"./types\";\n\n/**\n * Checks on field values before they are stored and again before they are\n * rendered. Pure and dependency-free, so the same rules run on the server (what\n * may be written) and in the renderer (what rows already in the table may do).\n *\n * Why it matters: an editor types these, a visitor's browser then acts on them.\n * A link whose href is `javascript:...` is a script that runs for whoever\n * clicks it, so a low-privilege editor account must not be able to store one.\n */\n\nexport const OVERRIDE_TYPES: readonly OverrideType[] = [\"text\", \"link\", \"image\", \"button\"];\n\nexport const LIMITS = {\n  pathKey: 200,\n  text: 20_000,\n  url: 2_048,\n  alt: 1_000,\n  dimension: 20_000,\n} as const;\n\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f]/;\nconst SCHEME = /^([a-z][a-z0-9+.\\-]*):/i;\n\nconst LINK_SCHEMES = [\"http\", \"https\", \"mailto\", \"tel\"];\nconst IMAGE_SCHEMES = [\"http\", \"https\"];\n\nfunction allowedUrl(raw: unknown, schemes: readonly string[]): string | null {\n  if (typeof raw !== \"string\") return null;\n  const value = raw.trim();\n  if (!value || value.length > LIMITS.url || CONTROL_CHARS.test(value)) return null;\n  // A browser ignores whitespace inside a scheme (\"java\\tscript:\"), so look for\n  // one with it removed. Control characters are already refused above.\n  const scheme = value.replace(/\\s/g, \"\").match(SCHEME)?.[1]?.toLowerCase();\n  if (scheme && !schemes.includes(scheme)) return null;\n  return value;\n}\n\n/** The link, if it is a relative path, an anchor, or http(s)/mailto/tel; otherwise null. */\nexport function safeHref(raw: unknown): string | null {\n  return allowedUrl(raw, LINK_SCHEMES);\n}\n\n/** The image address, if it is relative or http(s); otherwise null. */\nexport function safeImageSrc(raw: unknown): string | null {\n  return allowedUrl(raw, IMAGE_SCHEMES);\n}\n\nexport function validPathKey(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const key = raw.trim();\n  return key && key.length <= LIMITS.pathKey && !CONTROL_CHARS.test(key) ? key : null;\n}\n\ntype Checked = { ok: true; value: OverrideValue } | { ok: false; error: string };\n\n/**\n * Validates a value from the browser and returns a clean copy: only known\n * fields, only the right shapes, bounded sizes. Anything else is an error, not\n * silently dropped, so a bad write fails visibly.\n */\nexport function validateOverrideValue(input: unknown): Checked {\n  if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n    return { ok: false, error: \"Invalid value.\" };\n  }\n  const v = input as Record<string, unknown>;\n  if (typeof v.type !== \"string\" || !OVERRIDE_TYPES.includes(v.type as OverrideType)) {\n    return { ok: false, error: `Unknown field type \"${String(v.type)}\".` };\n  }\n  const out: OverrideValue = { type: v.type as OverrideType };\n\n  if (v.text !== undefined) {\n    if (typeof v.text !== \"string\" || v.text.length > LIMITS.text) {\n      return { ok: false, error: `Text must be a string under ${LIMITS.text} characters.` };\n    }\n    out.text = v.text;\n  }\n  if (v.alt !== undefined) {\n    if (typeof v.alt !== \"string\" || v.alt.length > LIMITS.alt) {\n      return { ok: false, error: `Alt text must be under ${LIMITS.alt} characters.` };\n    }\n    out.alt = v.alt;\n  }\n  if (v.href !== undefined && v.href !== \"\") {\n    const href = safeHref(v.href);\n    if (href === null) {\n      return {\n        ok: false,\n        error: \"That link isn't allowed. Use a path like /about, or an http(s), mailto or tel address.\",\n      };\n    }\n    out.href = href;\n  } else if (v.href === \"\") {\n    out.href = \"\";\n  }\n  if (v.src !== undefined && v.src !== \"\") {\n    const src = safeImageSrc(v.src);\n    if (src === null) {\n      return { ok: false, error: \"That image address isn't allowed. Use a path or an http(s) URL.\" };\n    }\n    out.src = src;\n  } else if (v.src === \"\") {\n    out.src = \"\";\n  }\n  for (const key of [\"width\", \"height\"] as const) {\n    const n = v[key];\n    if (n === undefined) continue;\n    if (typeof n !== \"number\" || !Number.isFinite(n) || n <= 0 || n > LIMITS.dimension) {\n      return { ok: false, error: `Image ${key} is out of range.` };\n    }\n    out[key] = Math.round(n);\n  }\n  return { ok: true, value: out };\n}\n\nconst EMAIL_PATTERN = /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/;\n\n/** A normalized (trimmed, lower-cased) address, or null if it isn't a plausible one. RFC 5321 caps an address at 254 characters. */\nexport function cleanEmail(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const email = raw.trim().toLowerCase();\n  return email.length <= 254 && !CONTROL_CHARS.test(email) && EMAIL_PATTERN.test(email) ? email : null;\n}\n\nexport function isRole(raw: unknown): raw is GRRole {\n  return raw === \"admin\" || raw === \"editor\";\n}\n\n/** An identifier from the browser (a repeater or item id): a bounded string without control characters. */\nexport function validId(raw: unknown): string | null {\n  return typeof raw === \"string\" && raw.length > 0 && raw.length <= LIMITS.pathKey && !CONTROL_CHARS.test(raw)\n    ? raw\n    : null;\n}\n\n/** A list of ids: an array of valid ids, no longer than `max`. */\nexport function validIdList(raw: unknown, max = 1_000): string[] | null {\n  if (!Array.isArray(raw) || raw.length > max) return null;\n  const out: string[] = [];\n  for (const item of raw) {\n    const id = validId(item);\n    if (id === null) return null;\n    out.push(id);\n  }\n  return out;\n}\n"],"mappings":"AAYO,MAAM,iBAA0C,CAAC,QAAQ,QAAQ,SAAS,QAAQ;AAElF,MAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AAAA,EACL,WAAW;AACb;AAEA,MAAM,gBAAgB;AACtB,MAAM,SAAS;AAEf,MAAM,eAAe,CAAC,QAAQ,SAAS,UAAU,KAAK;AACtD,MAAM,gBAAgB,CAAC,QAAQ,OAAO;AAEtC,SAAS,WAAW,KAAc,SAA2C;AAC3E,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,IAAI,KAAK;AACvB,MAAI,CAAC,SAAS,MAAM,SAAS,OAAO,OAAO,cAAc,KAAK,KAAK,EAAG,QAAO;AAG7E,QAAM,SAAS,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY;AACxE,MAAI,UAAU,CAAC,QAAQ,SAAS,MAAM,EAAG,QAAO;AAChD,SAAO;AACT;AAGO,SAAS,SAAS,KAA6B;AACpD,SAAO,WAAW,KAAK,YAAY;AACrC;AAGO,SAAS,aAAa,KAA6B;AACxD,SAAO,WAAW,KAAK,aAAa;AACtC;AAEO,SAAS,aAAa,KAA6B;AACxD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,MAAM,IAAI,KAAK;AACrB,SAAO,OAAO,IAAI,UAAU,OAAO,WAAW,CAAC,cAAc,KAAK,GAAG,IAAI,MAAM;AACjF;AASO,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AAAA,EAC9C;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,SAAS,YAAY,CAAC,eAAe,SAAS,EAAE,IAAoB,GAAG;AAClF,WAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,OAAO,EAAE,IAAI,CAAC,KAAK;AAAA,EACvE;AACA,QAAM,MAAqB,EAAE,MAAM,EAAE,KAAqB;AAE1D,MAAI,EAAE,SAAS,QAAW;AACxB,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,SAAS,OAAO,MAAM;AAC7D,aAAO,EAAE,IAAI,OAAO,OAAO,+BAA+B,OAAO,IAAI,eAAe;AAAA,IACtF;AACA,QAAI,OAAO,EAAE;AAAA,EACf;AACA,MAAI,EAAE,QAAQ,QAAW;AACvB,QAAI,OAAO,EAAE,QAAQ,YAAY,EAAE,IAAI,SAAS,OAAO,KAAK;AAC1D,aAAO,EAAE,IAAI,OAAO,OAAO,0BAA0B,OAAO,GAAG,eAAe;AAAA,IAChF;AACA,QAAI,MAAM,EAAE;AAAA,EACd;AACA,MAAI,EAAE,SAAS,UAAa,EAAE,SAAS,IAAI;AACzC,UAAM,OAAO,SAAS,EAAE,IAAI;AAC5B,QAAI,SAAS,MAAM;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,MACT;AAAA,IACF;AACA,QAAI,OAAO;AAAA,EACb,WAAW,EAAE,SAAS,IAAI;AACxB,QAAI,OAAO;AAAA,EACb;AACA,MAAI,EAAE,QAAQ,UAAa,EAAE,QAAQ,IAAI;AACvC,UAAM,MAAM,aAAa,EAAE,GAAG;AAC9B,QAAI,QAAQ,MAAM;AAChB,aAAO,EAAE,IAAI,OAAO,OAAO,kEAAkE;AAAA,IAC/F;AACA,QAAI,MAAM;AAAA,EACZ,WAAW,EAAE,QAAQ,IAAI;AACvB,QAAI,MAAM;AAAA,EACZ;AACA,aAAW,OAAO,CAAC,SAAS,QAAQ,GAAY;AAC9C,UAAM,IAAI,EAAE,GAAG;AACf,QAAI,MAAM,OAAW;AACrB,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,WAAW;AAClF,aAAO,EAAE,IAAI,OAAO,OAAO,SAAS,GAAG,oBAAoB;AAAA,IAC7D;AACA,QAAI,GAAG,IAAI,KAAK,MAAM,CAAC;AAAA,EACzB;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;AAEA,MAAM,gBAAgB;AAGf,SAAS,WAAW,KAA6B;AACtD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AACrC,SAAO,MAAM,UAAU,OAAO,CAAC,cAAc,KAAK,KAAK,KAAK,cAAc,KAAK,KAAK,IAAI,QAAQ;AAClG;AAEO,SAAS,OAAO,KAA6B;AAClD,SAAO,QAAQ,WAAW,QAAQ;AACpC;AAGO,SAAS,QAAQ,KAA6B;AACnD,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,KAAK,IAAI,UAAU,OAAO,WAAW,CAAC,cAAc,KAAK,GAAG,IACvG,MACA;AACN;AAGO,SAAS,YAAY,KAAc,MAAM,KAAwB;AACtE,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,IAAK,QAAO;AACpD,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,KAAK;AACtB,UAAM,KAAK,QAAQ,IAAI;AACvB,QAAI,OAAO,KAAM,QAAO;AACxB,QAAI,KAAK,EAAE;AAAA,EACb;AACA,SAAO;AACT;","names":[]}

package/dist/email/console.d.ts

@@ -0,0 +1,24 @@
+import { GRInviteEvent, GRPasswordResetEvent } from '../core/adapter-types.js';
+import 'react';
+import '../core/types.js';
+
+/**
+ * A stand-in for resendEmails() while you're developing: nothing is sent, and
+ * each invite or password-reset link is printed to the server's terminal
+ * instead, so the whole flow can be tried locally with no mail provider.
+ *
+ *   ...(process.env.GUARDRAIL_EMAIL_FROM
+ *     ? resendEmails({ from: process.env.GUARDRAIL_EMAIL_FROM, siteName: "My Site" })
+ *     : consoleEmails()),
+ *
+ * Refuses in production, with an error that reaches the admin who sent the
+ * invite. A link is as good as a password for choosing one, so it doesn't
+ * belong in a production log — a deployed site without email configured should
+ * say so rather than quietly writing them there.
+ */
+declare function consoleEmails(): {
+    onInvite: (event: GRInviteEvent) => void;
+    onPasswordReset: (event: GRPasswordResetEvent) => void;
+};
+
+export { consoleEmails };

package/dist/email/console.js

@@ -0,0 +1,30 @@
+function consoleEmails() {
+  const refuseInProduction = () => {
+    if (process.env.NODE_ENV === "production") {
+      throw new Error(
+        `no email provider is configured, so this can't be sent \u2014 set GUARDRAIL_EMAIL_FROM and RESEND_API_KEY (see the README's "Passwords, invites and resets").`
+      );
+    }
+  };
+  return {
+    onInvite: (event) => {
+      refuseInProduction();
+      const what = event.isNewUser === false ? `${event.email} already has an account \u2014 they'd be told they've been added` : `Invite for ${event.email} (${event.role})`;
+      console.log(`
+[guardrail] ${what}. Nothing was emailed (development only):
+  ${event.link ?? "(no link: this auth adapter can't create one)"}
+`);
+    },
+    onPasswordReset: (event) => {
+      refuseInProduction();
+      console.log(`
+[guardrail] Password reset for ${event.email}. Nothing was emailed (development only):
+  ${event.link}
+`);
+    }
+  };
+}
+export {
+  consoleEmails
+};
+//# sourceMappingURL=console.js.map

package/dist/email/console.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/email/console.ts"],"sourcesContent":["import type { GRInviteEvent, GRPasswordResetEvent } from \"../core/adapter-types\";\n\n/**\n * A stand-in for resendEmails() while you're developing: nothing is sent, and\n * each invite or password-reset link is printed to the server's terminal\n * instead, so the whole flow can be tried locally with no mail provider.\n *\n *   ...(process.env.GUARDRAIL_EMAIL_FROM\n *     ? resendEmails({ from: process.env.GUARDRAIL_EMAIL_FROM, siteName: \"My Site\" })\n *     : consoleEmails()),\n *\n * Refuses in production, with an error that reaches the admin who sent the\n * invite. A link is as good as a password for choosing one, so it doesn't\n * belong in a production log — a deployed site without email configured should\n * say so rather than quietly writing them there.\n */\nexport function consoleEmails() {\n  const refuseInProduction = () => {\n    if (process.env.NODE_ENV === \"production\") {\n      throw new Error(\n        \"no email provider is configured, so this can't be sent — set GUARDRAIL_EMAIL_FROM and RESEND_API_KEY (see the README's \\\"Passwords, invites and resets\\\").\",\n      );\n    }\n  };\n\n  return {\n    onInvite: (event: GRInviteEvent): void => {\n      refuseInProduction();\n      const what =\n        event.isNewUser === false\n          ? `${event.email} already has an account — they'd be told they've been added`\n          : `Invite for ${event.email} (${event.role})`;\n      console.log(`\\n[guardrail] ${what}. Nothing was emailed (development only):\\n  ${event.link ?? \"(no link: this auth adapter can't create one)\"}\\n`);\n    },\n    onPasswordReset: (event: GRPasswordResetEvent): void => {\n      refuseInProduction();\n      console.log(`\\n[guardrail] Password reset for ${event.email}. Nothing was emailed (development only):\\n  ${event.link}\\n`);\n    },\n  };\n}\n"],"mappings":"AAgBO,SAAS,gBAAgB;AAC9B,QAAM,qBAAqB,MAAM;AAC/B,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,CAAC,UAA+B;AACxC,yBAAmB;AACnB,YAAM,OACJ,MAAM,cAAc,QAChB,GAAG,MAAM,KAAK,qEACd,cAAc,MAAM,KAAK,KAAK,MAAM,IAAI;AAC9C,cAAQ,IAAI;AAAA,cAAiB,IAAI;AAAA,IAAgD,MAAM,QAAQ,+CAA+C;AAAA,CAAI;AAAA,IACpJ;AAAA,IACA,iBAAiB,CAAC,UAAsC;AACtD,yBAAmB;AACnB,cAAQ,IAAI;AAAA,iCAAoC,MAAM,KAAK;AAAA,IAAgD,MAAM,IAAI;AAAA,CAAI;AAAA,IAC3H;AAAA,EACF;AACF;","names":[]}

package/dist/index.client.d.ts

@@ -5,7 +5,7 @@ export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './ser
 export { GRepeaterProps, RepeaterItemProps } from './react/Repeater/index.js';
 export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent } from './email/resend.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRateLimitHit, GRRateLimitName, GRRateLimiter, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';
 
@@ -20,5 +20,6 @@ declare const isEditor: (..._args: unknown[]) => never;
 declare const canEdit: (..._args: unknown[]) => never;
 declare const resendInvite: (..._args: unknown[]) => never;
 declare const resendEmails: (..._args: unknown[]) => never;
+declare const consoleEmails: (..._args: unknown[]) => never;
 
-export { GRepeater, canEdit, configureGuardrail, getFieldValue, getRepeaterItemBySlug, isAdmin, isEditor, listRepeaterItems, resendEmails, resendInvite, withGuardrail };
+export { GRepeater, canEdit, configureGuardrail, consoleEmails, getFieldValue, getRepeaterItemBySlug, isAdmin, isEditor, listRepeaterItems, resendEmails, resendInvite, withGuardrail };

package/dist/index.client.js

@@ -69,12 +69,17 @@ const resendEmails = serverOnly(
   "resendEmails()",
   "Spread it into withGuardrail(), which runs in your root layout."
 );
+const consoleEmails = serverOnly(
+  "consoleEmails()",
+  "Spread it into withGuardrail(), which runs in your root layout."
+);
 export {
   GRail,
   GRepeater,
   addRepeaterItem,
   canEdit,
   configureGuardrail,
+  consoleEmails,
   createAssetUpload,
   forgotPasswordAction,
   getFieldValue,

package/dist/index.client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;","names":[]}
+{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\nexport const consoleEmails = serverOnly(\n  \"consoleEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n  GRRateLimiter,\n  GRRateLimitHit,\n  GRRateLimitName,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;","names":[]}

package/dist/index.d.ts

@@ -7,9 +7,10 @@ export { getRepeaterItemBySlug, listRepeaterItems } from './server/repeaterData.
 export { getFieldValue } from './server/fieldData.js';
 export { canEdit, isAdmin, isEditor } from './server/access.js';
 export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent, resendEmails, resendInvite } from './email/resend.js';
+export { consoleEmails } from './email/console.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { useGRail } from './react/Provider.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRateLimitHit, GRRateLimitName, GRRateLimiter, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/index.js

@@ -22,6 +22,7 @@ import {
 import { getFieldValue } from "./server/fieldData";
 import { isAdmin, isEditor, canEdit } from "./server/access";
 import { resendInvite, resendEmails } from "./email/resend";
+import { consoleEmails } from "./email/console";
 import {
   addRepeaterItem,
   removeRepeaterItem,
@@ -34,6 +35,7 @@ export {
   addRepeaterItem,
   canEdit,
   configureGuardrail,
+  consoleEmails,
   createAssetUpload,
   forgotPasswordAction,
   getFieldValue,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAU3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport { consoleEmails } from \"./email/console\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n  GRRateLimiter,\n  GRRateLimitHit,\n  GRRateLimitName,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAC3C,SAAS,qBAAqB;AAU9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}

package/dist/react/AuthRedirectSync.js

@@ -6,29 +6,35 @@ function AuthRedirectSync() {
   const searchParams = useSearchParams();
   const handled = useRef(false);
   useEffect(() => {
-    if (handled.current) return;
-    const rawHash = window.location.hash.startsWith("#") ? window.location.hash.slice(1) : window.location.hash;
-    const hasHashTokens = /(?:^|&)access_token=/.test(rawHash);
-    const code = searchParams.get("code") ?? void 0;
-    const tokenHash = searchParams.get("token_hash") ?? void 0;
-    const type = searchParams.get("type") ?? void 0;
-    if (!hasHashTokens && !code && !tokenHash) return;
-    handled.current = true;
-    const params = {
-      ...hasHashTokens ? { hash: rawHash } : {},
-      ...code ? { code } : {},
-      ...tokenHash ? { tokenHash } : {},
-      ...type ? { type } : {}
+    const check = () => {
+      if (handled.current) return;
+      const rawHash = window.location.hash.startsWith("#") ? window.location.hash.slice(1) : window.location.hash;
+      const hasHashTokens = /(?:^|&)access_token=/.test(rawHash);
+      const hashParams = new URLSearchParams(rawHash);
+      const code = searchParams.get("code") ?? void 0;
+      const tokenHash = hashParams.get("token_hash") ?? searchParams.get("token_hash") ?? void 0;
+      const type = hashParams.get("type") ?? searchParams.get("type") ?? void 0;
+      if (!hasHashTokens && !code && !tokenHash) return;
+      handled.current = true;
+      const params = {
+        ...hasHashTokens ? { hash: rawHash } : {},
+        ...code ? { code } : {},
+        ...tokenHash ? { tokenHash } : {},
+        ...type ? { type } : {}
+      };
+      completeAuthRedirectAction(params).then((res) => {
+        const url = new URL(window.location.href);
+        url.hash = "";
+        url.searchParams.delete("code");
+        url.searchParams.delete("token_hash");
+        url.searchParams.delete("type");
+        window.history.replaceState(null, "", url.toString());
+        window.location.reload();
+      });
     };
-    completeAuthRedirectAction(params).then((res) => {
-      const url = new URL(window.location.href);
-      url.hash = "";
-      url.searchParams.delete("code");
-      url.searchParams.delete("token_hash");
-      url.searchParams.delete("type");
-      window.history.replaceState(null, "", url.toString());
-      window.location.reload();
-    });
+    check();
+    window.addEventListener("hashchange", check);
+    return () => window.removeEventListener("hashchange", check);
   }, [searchParams]);
   return null;
 }

package/dist/react/AuthRedirectSync.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/AuthRedirectSync.tsx"],"sourcesContent":["\"use client\";\n\nimport { useEffect, useRef } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { completeAuthRedirectAction } from \"../server/actions\";\n\n/**\n * Notices a session that arrived via a redirect link — an invite, magic\n * link, or password-recovery email — and hands whatever it found to\n * completeAuthRedirectAction, which defers to the auth adapter's own\n * completeAuthRedirect for the actual exchange. Deliberately generic: this\n * file has no idea what a Supabase token looks like, only that a hash\n * carrying `access_token=` or a `code`/`token_hash` query param might be one.\n *\n * Has to run client-side and unconditionally (not gated behind edit mode,\n * unlike EditSyncer) — an invite link redirects to the site's plain URL, not\n * necessarily one with ?edit=true, and hash-based tokens never reach the\n * server on their own; only the browser ever sees window.location.hash.\n *\n * Mirrors the community-documented pattern for this exact problem, just\n * generalized across whichever redirect style a provider's own email\n * templates happen to produce, rather than requiring one specific route.\n */\nexport function AuthRedirectSync() {\n  const searchParams = useSearchParams();\n  const handled = useRef(false);\n\n  useEffect(() => {\n    if (handled.current) return;\n\n    const rawHash = window.location.hash.startsWith(\"#\")\n      ? window.location.hash.slice(1)\n      : window.location.hash;\n    // The one thing worth checking before assuming this hash is ours: every\n    // normal page load has an empty hash, and this runs on all of them.\n    const hasHashTokens = /(?:^|&)access_token=/.test(rawHash);\n\n    const code = searchParams.get(\"code\") ?? undefined;\n    const tokenHash = searchParams.get(\"token_hash\") ?? undefined;\n    const type = searchParams.get(\"type\") ?? undefined;\n\n    if (!hasHashTokens && !code && !tokenHash) return;\n    handled.current = true;\n\n    const params = {\n      ...(hasHashTokens ? { hash: rawHash } : {}),\n      ...(code ? { code } : {}),\n      ...(tokenHash ? { tokenHash } : {}),\n      ...(type ? { type } : {}),\n    };\n\n    completeAuthRedirectAction(params).then((res) => {\n      // Stripped either way — a token that failed to exchange (already used,\n      // expired) has no business lingering in the address bar or history\n      // either.\n      const url = new URL(window.location.href);\n      url.hash = \"\";\n      url.searchParams.delete(\"code\");\n      url.searchParams.delete(\"token_hash\");\n      url.searchParams.delete(\"type\");\n      window.history.replaceState(null, \"\", url.toString());\n\n      // A full reload, not router.refresh(): the session was just set via\n      // cookies a Server Action wrote, and the current page's React tree\n      // (including this component) was built from the pre-session render —\n      // simplest to just start over. On failure the action set a cookie\n      // explaining it, and a reload is what shows that, rather than leaving the\n      // person on a page where nothing visibly happened.\n      window.location.reload();\n    });\n  }, [searchParams]);\n\n  return null;\n}\n"],"mappings":";AAEA,SAAS,WAAW,cAAc;AAClC,SAAS,uBAAuB;AAChC,SAAS,kCAAkC;AAmBpC,SAAS,mBAAmB;AACjC,QAAM,eAAe,gBAAgB;AACrC,QAAM,UAAU,OAAO,KAAK;AAE5B,YAAU,MAAM;AACd,QAAI,QAAQ,QAAS;AAErB,UAAM,UAAU,OAAO,SAAS,KAAK,WAAW,GAAG,IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,IAC5B,OAAO,SAAS;AAGpB,UAAM,gBAAgB,uBAAuB,KAAK,OAAO;AAEzD,UAAM,OAAO,aAAa,IAAI,MAAM,KAAK;AACzC,UAAM,YAAY,aAAa,IAAI,YAAY,KAAK;AACpD,UAAM,OAAO,aAAa,IAAI,MAAM,KAAK;AAEzC,QAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAW;AAC3C,YAAQ,UAAU;AAElB,UAAM,SAAS;AAAA,MACb,GAAI,gBAAgB,EAAE,MAAM,QAAQ,IAAI,CAAC;AAAA,MACzC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACzB;AAEA,+BAA2B,MAAM,EAAE,KAAK,CAAC,QAAQ;AAI/C,YAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;AACxC,UAAI,OAAO;AACX,UAAI,aAAa,OAAO,MAAM;AAC9B,UAAI,aAAa,OAAO,YAAY;AACpC,UAAI,aAAa,OAAO,MAAM;AAC9B,aAAO,QAAQ,aAAa,MAAM,IAAI,IAAI,SAAS,CAAC;AAQpD,aAAO,SAAS,OAAO;AAAA,IACzB,CAAC;AAAA,EACH,GAAG,CAAC,YAAY,CAAC;AAEjB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/react/AuthRedirectSync.tsx"],"sourcesContent":["\"use client\";\n\nimport { useEffect, useRef } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { completeAuthRedirectAction } from \"../server/actions\";\n\n/**\n * Notices a session that arrived via a redirect link — an invite, magic\n * link, or password-recovery email — and hands whatever it found to\n * completeAuthRedirectAction, which defers to the auth adapter's own\n * completeAuthRedirect for the actual exchange. Deliberately generic: this\n * file has no idea what a Supabase token looks like, only that a hash\n * carrying `access_token=` or a `code`/`token_hash` query param might be one.\n *\n * Has to run client-side and unconditionally (not gated behind edit mode,\n * unlike EditSyncer) — an invite link redirects to the site's plain URL, not\n * necessarily one with ?edit=true, and hash-based tokens never reach the\n * server on their own; only the browser ever sees window.location.hash.\n *\n * Mirrors the community-documented pattern for this exact problem, just\n * generalized across whichever redirect style a provider's own email\n * templates happen to produce, rather than requiring one specific route.\n */\nexport function AuthRedirectSync() {\n  const searchParams = useSearchParams();\n  const handled = useRef(false);\n\n  useEffect(() => {\n    const check = () => {\n      if (handled.current) return;\n\n      const rawHash = window.location.hash.startsWith(\"#\")\n        ? window.location.hash.slice(1)\n        : window.location.hash;\n      // The one thing worth checking before assuming this hash is ours: every\n      // normal page load has an empty hash, and this runs on all of them.\n      const hasHashTokens = /(?:^|&)access_token=/.test(rawHash);\n\n      // Links Guardrail mints carry token_hash/type in the fragment; the query\n      // string is still read for links emailed before that change.\n      const hashParams = new URLSearchParams(rawHash);\n      const code = searchParams.get(\"code\") ?? undefined;\n      const tokenHash =\n        hashParams.get(\"token_hash\") ?? searchParams.get(\"token_hash\") ?? undefined;\n      const type = hashParams.get(\"type\") ?? searchParams.get(\"type\") ?? undefined;\n\n      if (!hasHashTokens && !code && !tokenHash) return;\n      handled.current = true;\n\n      const params = {\n        ...(hasHashTokens ? { hash: rawHash } : {}),\n        ...(code ? { code } : {}),\n        ...(tokenHash ? { tokenHash } : {}),\n        ...(type ? { type } : {}),\n      };\n\n      completeAuthRedirectAction(params).then((res) => {\n        // Stripped either way — a token that failed to exchange (already used,\n        // expired) has no business lingering in the address bar or history\n        // either.\n        const url = new URL(window.location.href);\n        url.hash = \"\";\n        url.searchParams.delete(\"code\");\n        url.searchParams.delete(\"token_hash\");\n        url.searchParams.delete(\"type\");\n        window.history.replaceState(null, \"\", url.toString());\n\n        // A full reload, not router.refresh(): the session was just set via\n        // cookies a Server Action wrote, and the current page's React tree\n        // (including this component) was built from the pre-session render —\n        // simplest to just start over. On failure the action set a cookie\n        // explaining it, and a reload is what shows that, rather than leaving the\n        // person on a page where nothing visibly happened.\n        window.location.reload();\n      });\n    };\n\n    check();\n    // A link pasted into a tab that already has the site open changes only the\n    // fragment, which is not a page load.\n    window.addEventListener(\"hashchange\", check);\n    return () => window.removeEventListener(\"hashchange\", check);\n  }, [searchParams]);\n\n  return null;\n}\n"],"mappings":";AAEA,SAAS,WAAW,cAAc;AAClC,SAAS,uBAAuB;AAChC,SAAS,kCAAkC;AAmBpC,SAAS,mBAAmB;AACjC,QAAM,eAAe,gBAAgB;AACrC,QAAM,UAAU,OAAO,KAAK;AAE5B,YAAU,MAAM;AACd,UAAM,QAAQ,MAAM;AAClB,UAAI,QAAQ,QAAS;AAErB,YAAM,UAAU,OAAO,SAAS,KAAK,WAAW,GAAG,IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,IAC5B,OAAO,SAAS;AAGpB,YAAM,gBAAgB,uBAAuB,KAAK,OAAO;AAIzD,YAAM,aAAa,IAAI,gBAAgB,OAAO;AAC9C,YAAM,OAAO,aAAa,IAAI,MAAM,KAAK;AACzC,YAAM,YACJ,WAAW,IAAI,YAAY,KAAK,aAAa,IAAI,YAAY,KAAK;AACpE,YAAM,OAAO,WAAW,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK;AAEnE,UAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAW;AAC3C,cAAQ,UAAU;AAElB,YAAM,SAAS;AAAA,QACb,GAAI,gBAAgB,EAAE,MAAM,QAAQ,IAAI,CAAC;AAAA,QACzC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACvB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,QACjC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACzB;AAEA,iCAA2B,MAAM,EAAE,KAAK,CAAC,QAAQ;AAI/C,cAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;AACxC,YAAI,OAAO;AACX,YAAI,aAAa,OAAO,MAAM;AAC9B,YAAI,aAAa,OAAO,YAAY;AACpC,YAAI,aAAa,OAAO,MAAM;AAC9B,eAAO,QAAQ,aAAa,MAAM,IAAI,IAAI,SAAS,CAAC;AAQpD,eAAO,SAAS,OAAO;AAAA,MACzB,CAAC;AAAA,IACH;AAEA,UAAM;AAGN,WAAO,iBAAiB,cAAc,KAAK;AAC3C,WAAO,MAAM,OAAO,oBAAoB,cAAc,KAAK;AAAA,EAC7D,GAAG,CAAC,YAAY,CAAC;AAEjB,SAAO;AACT;","names":[]}

package/dist/react/GRail/render.js

@@ -2,6 +2,7 @@ import { jsx } from "react/jsx-runtime";
 import React from "react";
 import NextImage from "next/image";
 import NextLink from "next/link";
+import { safeHref, safeImageSrc } from "../../core/validate";
 function intrinsicSize(override, width, height) {
   const { width: nw, height: nh } = override;
   if (nw && nh) {
@@ -22,7 +23,7 @@ function GRailRender({ as, override, children, ref, ...rest }) {
       type: _overrideType,
       ...imgRest
     } = rest;
-    const src = override.src || propSrc || "";
+    const src = safeImageSrc(override.src) || propSrc || "";
     const alt = override.alt ?? propAlt ?? "";
     if (!src) return null;
     const imgRef = ref;
@@ -53,7 +54,7 @@ function GRailRender({ as, override, children, ref, ...rest }) {
       {
         ref,
         ...linkRest,
-        href: override.href || propHref || "#",
+        href: safeHref(override.href) || propHref || "#",
         children: override.text || children
       }
     );

package/dist/react/GRail/render.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/react/GRail/render.tsx"],"sourcesContent":["import React from \"react\";\nimport NextImage from \"next/image\";\nimport NextLink from \"next/link\";\nimport type { HTMLKeys, OverrideValue } from \"../../core/types\";\n\ninterface RenderProps {\n  as?: HTMLKeys;\n  override: OverrideValue;\n  children?: React.ReactNode;\n  /** Forwarded to the rendered element so the editor can measure it. */\n  ref?: React.Ref<HTMLElement>;\n  [key: string]: unknown;\n}\n\n/**\n * The developer's width/height set the layout; the image's own proportions set\n * the shape. Keeping the developer's width and deriving height from the stored\n * natural size means a differently shaped replacement neither breaks the\n * layout nor gets stretched.\n */\nfunction intrinsicSize(override: OverrideValue, width?: number, height?: number) {\n  const { width: nw, height: nh } = override;\n  if (nw && nh) {\n    if (width) return { width, height: Math.round((width * nh) / nw) };\n    if (height) return { width: Math.round((height * nw) / nh), height };\n    return { width: nw, height: nh };\n  }\n  return { width: width || 500, height: height || 500 };\n}\n\n/**\n * Renders a resolved value as plain markup. Shared by the anonymous SSR path\n * and the editor, so what an editor sees matches what ships.\n *\n * Resolved props are applied *after* the spread. The developer's original\n * src/href are still in `rest`, and spreading them last silently masked every\n * saved image and link override.\n */\nexport function GRailRender({ as, override, children, ref, ...rest }: RenderProps) {\n  if (override.type === \"image\") {\n    const {\n      width,\n      height,\n      fill,\n      src: propSrc,\n      alt: propAlt,\n      type: _overrideType,\n      ...imgRest\n    } = rest as Record<string, any>;\n    const src = override.src || propSrc || \"\";\n    const alt = override.alt ?? propAlt ?? \"\";\n    if (!src) return null;\n\n    const imgRef = ref as React.Ref<HTMLImageElement>;\n    if (fill) {\n      return <NextImage ref={imgRef} {...imgRest} src={src} alt={alt} fill />;\n    }\n\n    const size = intrinsicSize(\n      override,\n      Number(width) || undefined,\n      Number(height) || undefined,\n    );\n    return (\n      <NextImage\n        ref={imgRef}\n        {...imgRest}\n        src={src}\n        alt={alt}\n        width={size.width}\n        height={size.height}\n      />\n    );\n  }\n\n  if (override.type === \"link\") {\n    const { href: propHref, type: _overrideType, ...linkRest } =\n      rest as Record<string, any>;\n    return (\n      <NextLink\n        ref={ref as React.Ref<HTMLAnchorElement>}\n        {...linkRest}\n        href={override.href || propHref || \"#\"}\n      >\n        {override.text || children}\n      </NextLink>\n    );\n  }\n\n  const Component = (as || \"span\") as React.ElementType;\n  return (\n    <Component ref={ref} {...rest}>\n      {override.text || children}\n    </Component>\n  );\n}\n"],"mappings":"AAuDa;AAvDb,OAAO,WAAW;AAClB,OAAO,eAAe;AACtB,OAAO,cAAc;AAkBrB,SAAS,cAAc,UAAyB,OAAgB,QAAiB;AAC/E,QAAM,EAAE,OAAO,IAAI,QAAQ,GAAG,IAAI;AAClC,MAAI,MAAM,IAAI;AACZ,QAAI,MAAO,QAAO,EAAE,OAAO,QAAQ,KAAK,MAAO,QAAQ,KAAM,EAAE,EAAE;AACjE,QAAI,OAAQ,QAAO,EAAE,OAAO,KAAK,MAAO,SAAS,KAAM,EAAE,GAAG,OAAO;AACnE,WAAO,EAAE,OAAO,IAAI,QAAQ,GAAG;AAAA,EACjC;AACA,SAAO,EAAE,OAAO,SAAS,KAAK,QAAQ,UAAU,IAAI;AACtD;AAUO,SAAS,YAAY,EAAE,IAAI,UAAU,UAAU,KAAK,GAAG,KAAK,GAAgB;AACjF,MAAI,SAAS,SAAS,SAAS;AAC7B,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,IACL,IAAI;AACJ,UAAM,MAAM,SAAS,OAAO,WAAW;AACvC,UAAM,MAAM,SAAS,OAAO,WAAW;AACvC,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS;AACf,QAAI,MAAM;AACR,aAAO,oBAAC,aAAU,KAAK,QAAS,GAAG,SAAS,KAAU,KAAU,MAAI,MAAC;AAAA,IACvE;AAEA,UAAM,OAAO;AAAA,MACX;AAAA,MACA,OAAO,KAAK,KAAK;AAAA,MACjB,OAAO,MAAM,KAAK;AAAA,IACpB;AACA,WACE;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACJ,GAAG;AAAA,QACJ;AAAA,QACA;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA;AAAA,IACf;AAAA,EAEJ;AAEA,MAAI,SAAS,SAAS,QAAQ;AAC5B,UAAM,EAAE,MAAM,UAAU,MAAM,eAAe,GAAG,SAAS,IACvD;AACF,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACC,GAAG;AAAA,QACJ,MAAM,SAAS,QAAQ,YAAY;AAAA,QAElC,mBAAS,QAAQ;AAAA;AAAA,IACpB;AAAA,EAEJ;AAEA,QAAM,YAAa,MAAM;AACzB,SACE,oBAAC,aAAU,KAAW,GAAG,MACtB,mBAAS,QAAQ,UACpB;AAEJ;","names":[]}
+{"version":3,"sources":["../../../src/react/GRail/render.tsx"],"sourcesContent":["import React from \"react\";\nimport NextImage from \"next/image\";\nimport NextLink from \"next/link\";\nimport type { HTMLKeys, OverrideValue } from \"../../core/types\";\nimport { safeHref, safeImageSrc } from \"../../core/validate\";\n\ninterface RenderProps {\n  as?: HTMLKeys;\n  override: OverrideValue;\n  children?: React.ReactNode;\n  /** Forwarded to the rendered element so the editor can measure it. */\n  ref?: React.Ref<HTMLElement>;\n  [key: string]: unknown;\n}\n\n/**\n * The developer's width/height set the layout; the image's own proportions set\n * the shape. Keeping the developer's width and deriving height from the stored\n * natural size means a differently shaped replacement neither breaks the\n * layout nor gets stretched.\n */\nfunction intrinsicSize(override: OverrideValue, width?: number, height?: number) {\n  const { width: nw, height: nh } = override;\n  if (nw && nh) {\n    if (width) return { width, height: Math.round((width * nh) / nw) };\n    if (height) return { width: Math.round((height * nw) / nh), height };\n    return { width: nw, height: nh };\n  }\n  return { width: width || 500, height: height || 500 };\n}\n\n/**\n * Renders a resolved value as plain markup. Shared by the anonymous SSR path\n * and the editor, so what an editor sees matches what ships.\n *\n * Resolved props are applied *after* the spread. The developer's original\n * src/href are still in `rest`, and spreading them last silently masked every\n * saved image and link override.\n */\nexport function GRailRender({ as, override, children, ref, ...rest }: RenderProps) {\n  if (override.type === \"image\") {\n    const {\n      width,\n      height,\n      fill,\n      src: propSrc,\n      alt: propAlt,\n      type: _overrideType,\n      ...imgRest\n    } = rest as Record<string, any>;\n    // Rows written before values were validated may hold anything; only\n    // http(s) and relative addresses are rendered.\n    const src = safeImageSrc(override.src) || propSrc || \"\";\n    const alt = override.alt ?? propAlt ?? \"\";\n    if (!src) return null;\n\n    const imgRef = ref as React.Ref<HTMLImageElement>;\n    if (fill) {\n      return <NextImage ref={imgRef} {...imgRest} src={src} alt={alt} fill />;\n    }\n\n    const size = intrinsicSize(\n      override,\n      Number(width) || undefined,\n      Number(height) || undefined,\n    );\n    return (\n      <NextImage\n        ref={imgRef}\n        {...imgRest}\n        src={src}\n        alt={alt}\n        width={size.width}\n        height={size.height}\n      />\n    );\n  }\n\n  if (override.type === \"link\") {\n    const { href: propHref, type: _overrideType, ...linkRest } =\n      rest as Record<string, any>;\n    return (\n      <NextLink\n        ref={ref as React.Ref<HTMLAnchorElement>}\n        {...linkRest}\n        href={safeHref(override.href) || propHref || \"#\"}\n      >\n        {override.text || children}\n      </NextLink>\n    );\n  }\n\n  const Component = (as || \"span\") as React.ElementType;\n  return (\n    <Component ref={ref} {...rest}>\n      {override.text || children}\n    </Component>\n  );\n}\n"],"mappings":"AA0Da;AA1Db,OAAO,WAAW;AAClB,OAAO,eAAe;AACtB,OAAO,cAAc;AAErB,SAAS,UAAU,oBAAoB;AAiBvC,SAAS,cAAc,UAAyB,OAAgB,QAAiB;AAC/E,QAAM,EAAE,OAAO,IAAI,QAAQ,GAAG,IAAI;AAClC,MAAI,MAAM,IAAI;AACZ,QAAI,MAAO,QAAO,EAAE,OAAO,QAAQ,KAAK,MAAO,QAAQ,KAAM,EAAE,EAAE;AACjE,QAAI,OAAQ,QAAO,EAAE,OAAO,KAAK,MAAO,SAAS,KAAM,EAAE,GAAG,OAAO;AACnE,WAAO,EAAE,OAAO,IAAI,QAAQ,GAAG;AAAA,EACjC;AACA,SAAO,EAAE,OAAO,SAAS,KAAK,QAAQ,UAAU,IAAI;AACtD;AAUO,SAAS,YAAY,EAAE,IAAI,UAAU,UAAU,KAAK,GAAG,KAAK,GAAgB;AACjF,MAAI,SAAS,SAAS,SAAS;AAC7B,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,IACL,IAAI;AAGJ,UAAM,MAAM,aAAa,SAAS,GAAG,KAAK,WAAW;AACrD,UAAM,MAAM,SAAS,OAAO,WAAW;AACvC,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS;AACf,QAAI,MAAM;AACR,aAAO,oBAAC,aAAU,KAAK,QAAS,GAAG,SAAS,KAAU,KAAU,MAAI,MAAC;AAAA,IACvE;AAEA,UAAM,OAAO;AAAA,MACX;AAAA,MACA,OAAO,KAAK,KAAK;AAAA,MACjB,OAAO,MAAM,KAAK;AAAA,IACpB;AACA,WACE;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACJ,GAAG;AAAA,QACJ;AAAA,QACA;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA;AAAA,IACf;AAAA,EAEJ;AAEA,MAAI,SAAS,SAAS,QAAQ;AAC5B,UAAM,EAAE,MAAM,UAAU,MAAM,eAAe,GAAG,SAAS,IACvD;AACF,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACC,GAAG;AAAA,QACJ,MAAM,SAAS,SAAS,IAAI,KAAK,YAAY;AAAA,QAE5C,mBAAS,QAAQ;AAAA;AAAA,IACpB;AAAA,EAEJ;AAEA,QAAM,YAAa,MAAM;AACzB,SACE,oBAAC,aAAU,KAAW,GAAG,MACtB,mBAAS,QAAQ,UACpB;AAEJ;","names":[]}